Analysis

  • max time kernel
    93s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/08/2026, 00:13

General

  • Target
    2026-07-31_171a28ef4a87f5968f761cdbf1b070b8_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 23.0MB
  • Sample260801-ahsftsbm5t
  • SHA256 46e8eec98a765be0bcd199c7869ba892e75a9c6524a7620577d4c75b2b8db3aa
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_171a28ef4a87f5968f761cdbf1b070b8_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_171a28ef4a87f5968f761cdbf1b070b8_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1584
  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_171a28ef4a87f5968f761cdbf1b070b8_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-31_171a28ef4a87f5968f761cdbf1b070b8_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5104

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 23.7MB
        • SHA256 718bd5f353d901983f2a4d43de3710f4ca20ed74b118209b0c03ef3a267f4efd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 23.0MB
        • SHA256 46e8eec98a765be0bcd199c7869ba892e75a9c6524a7620577d4c75b2b8db3aa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 46.3MB
        • SHA256 b2d0173bffcfba2b6b10319a672e6261dfcea1d1cd4889bffa0945d71fc9bc9b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 46.0MB
        • SHA256 84e2b7d053c54332e47952d0c942d0b01dbd5c2ada1bb9c4e353135b921bfad1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 23.3MB
        • SHA256 128b081ee35c559de7b4c87bd525989e8655f4d561c2e36e202c57e74d35a559
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 53.1MB
        • SHA256 5d0f79b37e5e3c329740a1fa29f0937cdc02f78991bcd8d1c192c6ac1d880d99
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 48.1MB
        • SHA256 c8ecd880831c0a5c7bdd2e300458fe897819d737980ab7e14cb150d665261582
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 31.3MB
        • SHA256 b3a8d65731728b585dbe9596a0277073e66d9d247b0827c4837daa7c31c711fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 20.3MB
        • SHA256 96a554ddc71440620b384edb03dfd2445f393f050f91f6c6c6f0f996bbf53093
        • MD5 SHA1 SHA512 SSDEEP TLSH

        setup.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 20.1MB
        • SHA256 386ed868f367b3c786499c485271b221927672d7af0e42a1ab7b79203a6559c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 21.8MB
        • SHA256 f52717e3fc9a129839ab28bcaa0aabfc69ef5e90dbf1852300b7a4703550dff5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 24.3MB
        • SHA256 62560dc3b875aec4c0dfa22f6f71d1e7f58447996be910c648246a4b6b4263de
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 21.9MB
        • SHA256 d028dea0598ba32ec9ff9c4da26d0eca5a82ecc8788305c17754d139849dc64c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 20.7MB
        • SHA256 048a6945abd83db212baa2a5b7d08778fe5645097bf0f3273749ed87a20627e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 192KB
        • SHA256 cc71df767f30aa32b4d730d3c0244896e3d45eb216f18568c46371d93640cac9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 19.9MB
        • SHA256 7202cf17078b3be93d9162f5504500f9ffb4dc4ce969ed3b7f4e5277c0a6cced
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 19.1MB
        • SHA256 28c5cee73b3187a0ed679cf5afefa137cd8913ff1f3498add2f9b1dd4fcbda79
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 18.5MB
        • SHA256 c364f5f4221d543caa34a42256a8875c84e4a05f8cbee12a71f860fb73290e13
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 20.0MB
        • SHA256 ddd8ac851cb25b0054bf938682c116fc91d44686d155e26c60c07e2bce9ecec7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 17.5MB
        • SHA256 3983638b1e5425ce8b92528d52d2ec70800617516ba0313c759078c2d871e7cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 20.0MB
        • SHA256 dffeaa249e3f849b99e4da7baa170b040504f73eb8a8b6b72e7b1beeb6ff3586
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 128KB
        • SHA256 018b597827351ef5fba9c0e1d321cfa9b45d887ff0f8d5607452eb75d8626cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 19.0MB
        • SHA256 157f86b6b220deca497bdda434035f0538d1640d730845fafec4cdacc158cebe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 18.8MB
        • SHA256 78a9c1627ae27c812328efc73e91d038a07c129c9de67ad5b34d40e6dbc79390
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 18.3MB
        • SHA256 d2a8d121229fe33dd1dbc7332c91798687ea955956359fef5a5b7921c81021b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 19.0MB
        • SHA256 e49dfbaddca73b281a01a414640a78a460753727f7e909de93946a1a1de13379
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 19.5MB
        • SHA256 aa934df4b5dadddbcd1dabe6085038d2f84e0b8506158fd6060e3716b154bf3e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 18.0MB
        • SHA256 0ec064be0eb35e7b608185c7e7c8eb6c9a7ba2c7eeea559819b88cfbd36f6a9a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 18.3MB
        • SHA256 6573a712541df1434ab98326be2e23d9b7f314c503f6cd08ecd02f8f232226be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 15.9MB
        • SHA256 52dd41bae5d43220fb86260b70793b01088311bef22afb997a112815d0bb02dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 18.0MB
        • SHA256 0f45d350f5cf184e3bdaa2ae70940405f5cce0290eb6848a8b2866f3ec327141
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 18.2MB
        • SHA256 2afdf7d452daba9c8b0acbfd8e4f493cc101999081bb6912937735be17a6c153
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 17.4MB
        • SHA256 3c18f5c12ea8f6db2cafce24a0d40d9c74f6f8d28ddb0b371d0be315ee08bb7e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 16.7MB
        • SHA256 2aec1f6d39702e9a0c8e6c90205bdde7d860b9befc43f4de96e47610cbd6ba80
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 18.1MB
        • SHA256 7cf4b5b82298b1b6daa92566493d2ca803c02d563739d430580d0e31801a2256
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 18.1MB
        • SHA256 a9bb177d1b64dffd34154043731551a1d9ab8523c6506b86a4d6ba5b132fc1e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 17.3MB
        • SHA256 1d936206e066b78f7f435dd19494998315d5030e9c77575bd43d9e2f11077da2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 16.2MB
        • SHA256 7e370bb0536f05a11b3ee9159250f4f9639b8884e6b09aa63ec03ed50b5fda33
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 16.4MB
        • SHA256 5102bf08ea79d3a08a854e2b3d7a642d0828d1e60249c182465d5c2237189323
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 18.1MB
        • SHA256 8b40a502ddbe9a9f367f4faad996411e1813b140b0b53422027b868d6cfd4134
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 17.0MB
        • SHA256 885bb6063730a2a7fb538979eb120fb9abf28aae981e5758ea7db38b4aa94cfc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 17.6MB
        • SHA256 aa9545141af49cc74b8206aac4a55e23e0483c365ed6c2adf058009b4fffde17
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 17.5MB
        • SHA256 cac6714497d1e5fcd1cf1bcb9a2c2a0caee1b5c959fae085218f416a5b3f41fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 17.9MB
        • SHA256 431591b0a01f63b7eacbe91c7df0387776106911594c3428b0aecaabffaaa3dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 17.1MB
        • SHA256 4251db937d4e91ca17162c74bd3adc7308c253b17519cc314914a54bff6feb7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 16.8MB
        • SHA256 0e81f583566f2eb014697e1479139240808adfd2ce9634c70d7f7701c38b2db1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 15.9MB
        • SHA256 960704dd75b81371d85d00409c7fb665ca1b82543ad6a9588c55fc4a50d1a802
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 16.3MB
        • SHA256 87c89a477cf670e8986e11388142e54ebb8985d16ba6137ad3bbb2245c25456c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 18.1MB
        • SHA256 e5f523d55c40eff7d1f96e770894b4996b98f45c605b8f0f0d7ce5db57a8b4a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 17.9MB
        • SHA256 34d5cf6f6bd86fec8a2046c335e81babb05dba51968d42589273f278c5e040ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 17.5MB
        • SHA256 c325f90eca22047cff5993b5b020ce44f55438cb246d3d4a31d2c94085b5dc5f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 16.6MB
        • SHA256 0b9f982bd0952a96c83c64bafe45f7e03ee5e32dc2389a4bcb0f552a84997e44
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 16.4MB
        • SHA256 e745634fb8bfb75506f70fd562abea42b8e43a39975bfd85c68d0eac6ec36679
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 17.2MB
        • SHA256 577ec48d6c95402682129c71a2c121acee6a07169031e344cbba645d1537f905
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 15.5MB
        • SHA256 3ca80536148957032acc63a397bd2d046960ecb218ee8fcb7d062dc4e5267034
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 18.0MB
        • SHA256 5516526682c4767df432adb95b5ee8eb3d5fe1b649b1c2d5139f20a61725b710
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 16.0MB
        • SHA256 a082767e5506bab80df15e896b2475c13fcd2263380370a149af160313e55fa5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 17.5MB
        • SHA256 f2ef4d80ecc19e79b3f6d96ddc23f02083d231b717b2ceeefa6b2ab87e2a28cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 17.9MB
        • SHA256 43c475f1dc964e60957ba4991fd652e996403d31ea5fdce4043988af3fa99aab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 17.3MB
        • SHA256 168484a22103502dc91f57955354707f2ef5fe51cfbf41bb40b04cc32d712908
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 27.7MB
        • SHA256 9afbd6aa7d5fd27adbf6d60b6e28358728d5172c709b2335ebed177dd3a90fc3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 22.2MB
        • SHA256 cce83871d08ead5d7048f1de1e1a44fda83696e863990e80595d8dcda0fa0804
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 22.2MB
        • SHA256 cf42d65e8fe795290aa3483cb309f2c5b267ba1e7a8b95f8af1d6edd84908f79
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 22.8MB
        • SHA256 41bfd57a52565ae75a5e41606f5ccc79f21bf356921688b114a63a31a66f92ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/1584-0-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/1584-2-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/5104-25-0x0000000000400000-0x00000000004E4000-memory.dmp