Overview

overview

8

Static

static

3

2026-08-02...ar.exe

windows10-2004-x64

8

2026-08-02...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    41s
  • max time network
    137s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 23:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_d15d6cf0cac78c69ebe24a22401df8c1_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 45.1MB
  • Sample260802-3mrdjsgr8z
  • SHA256 6a14b07c95f4c9ed277978dd71bcb0718f9e75c93211ec8b44fb3abc3cc2cfda
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_d15d6cf0cac78c69ebe24a22401df8c1_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_d15d6cf0cac78c69ebe24a22401df8c1_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6140
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_d15d6cf0cac78c69ebe24a22401df8c1_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-02_d15d6cf0cac78c69ebe24a22401df8c1_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5908

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 45.3MB
        • SHA256 2233f67edfd5d81fd0d201cdae4412b1a0b96e1eb5dda78521cd31c5e298973d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 79.9MB
        • SHA256 d7714dc2a56260e14b00139b88b65e1a6d46f3a034f4d4e24515bdaca6ab9320
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 72.6MB
        • SHA256 85652bce987780ef3c2f5c2950826a86f38656ab9922720401edb266051ee384
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 71.1MB
        • SHA256 e12668b82e572f992ed9e4e85eb027a2b24420326e06ed58d5b626ce251c9abb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 47.2MB
        • SHA256 180df7dd7cdd0248f67525e6f58e2f179cb320a5bf7305252959da35452707ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 67.2MB
        • SHA256 2c1540f7f5d6704d6eccbd5c44a37108a9b9628570be1e30c494d3c713272a94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 56.6MB
        • SHA256 2d84cae4fefade0cceadec88097d8f8c332885e525d1a0c2f7b96e04049045a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 54.9MB
        • SHA256 0402d66a94cfac5f76765abcc52b0c1c9a892d51c60e1057cd0bbad93e2f473a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 53.4MB
        • SHA256 4959318a6c8a331f5c3eadad42a57f11a0c6e3fa2798661c865380679d89695e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 52.1MB
        • SHA256 9f61533127bf9a3ffac6cda516a5f53b204bfeeaaa05db1185fc5299b988aa61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 50.1MB
        • SHA256 fe3a617028b4f8635f9d50d55c796c49c04ada01ce42a0069f9b1403964f9942
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 47.8MB
        • SHA256 652b1da536a824d6805634453713e9a15980590cbb3ea76003246d817b43a889
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 46.8MB
        • SHA256 87504052b47bfa4dd3ca1c0436f2e74f30baa0980518b8cde59189d12770bdf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 44.1MB
        • SHA256 4684478d1eb137f129be0caff7d8ff21992bbe6d49c13546f342a550d8e63bba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 41.9MB
        • SHA256 08a29c5a41e1590c12cdd43ce5c471b90d451ba5a943c1dadbea87b8bfa4c46a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 40.4MB
        • SHA256 f1de83dc292051ff3419caa0bafd4c6b93f91028a863f5a7f700b3bcb17c54a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 39.9MB
        • SHA256 68688e9bee9035b7e87862d3779e007714711030e31227732ad4a33a94502799
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 39.5MB
        • SHA256 260ee34f2337d7814c6b61246e9d8f3290f6204aeafbfdc8f33ba8fd4250e256
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 39.1MB
        • SHA256 7324f88e116fc412b793be1b31e84be52625bcfd37051105c0af5bb57a58eabe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 38.8MB
        • SHA256 e67b6a0e62eb8a8d9464cbde844fd3482834a60a4f0aea6eaa712d120fef5185
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 38.4MB
        • SHA256 0763fcf32da29735394a8c313f77268143705c80f38be4e3e9e36d4a810f3ed0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 38.2MB
        • SHA256 4765b985010f638864a1d7ea00d7e875d05020501006df383103f6df6e05f96a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 37.8MB
        • SHA256 1607296fac0310e129468fb5b48a41a10dc80d5e7893d7edf9228755847617f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 37.2MB
        • SHA256 a6a40ce762d7fdb8a797d4ae276b066a464c0b127b9b49fed71eef1e444476d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 36.9MB
        • SHA256 26928844df771168131686dbf231f79b689475ad7554f73509152c77d23667f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 36.5MB
        • SHA256 6287b7cadee07a5518ab6e05a583afdb838d44290833a22f4a0f7d42a0d10ae9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 36.0MB
        • SHA256 d08fbe2d9fc54c93ce50b4430c0e2f00b5eb34d3e7a64430dc997278528730b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 36.2MB
        • SHA256 71ac12f5bf3eaedfb2915e74b20639f82f65557aa41444ec941de988851cb5cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 36.6MB
        • SHA256 88edc275dd938a12789db7d8fb8bb9054545dc7c704d190a4d2a95904e5e39db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 35.1MB
        • SHA256 762be4dbaca5ef79a60c1fee32418fa2da74e987f941ca3a0b8a7a6ac3627c97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 34.7MB
        • SHA256 c82aa0520414ae86a8dcc8b2f8bd12c048c0d16c17891f12b9e967129d49d3a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 64KB
        • SHA256 d2eb08ebe0c7e7ff2223b6feb8c95f679251883e0b850d913bfa4b604432b861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 32.0MB
        • SHA256 d375e7b74e8439e81edcbb1a955cb352a411013703cbb92375f74730b6d7e0db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.2MB
        • SHA256 08272d12429b33fc1cf4e491dbf3b2ce9a493bdbbb3917b5de6f016d13512ce0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 30.4MB
        • SHA256 acb10b8f062c17dbb639f84eb029eeb584e2a939106c8a3dff7535f5ef8890f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.4MB
        • SHA256 6c752bb63ff3cc8827a3968f5e7d8547a7d771216a8f861eb57a421227f5778a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 28.4MB
        • SHA256 10a75196d210709528e115d30bbde71136154176eb4427befa542623fe4edbef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 27.6MB
        • SHA256 87297cb3781d9aa892dbbd4185f56744feb3bf00cc5196fd912b815bcacdf4b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 24.0MB
        • SHA256 4f6952ed41e46043026dc0609be06d483ff2da1490384213656f5bb4c7e0b120
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 23.4MB
        • SHA256 e2fc97b3defe73fe65515cd70b41ddb6f03628b08c2d1f12671d80f3bdd8bc17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 22.8MB
        • SHA256 59acf66c8cf32bba1d2024674c570b975ba132b0acfdc90816218110b44f34f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 22.2MB
        • SHA256 878db0f45a619af1aba3941cb04e605983612a9d838e4f4c806d87247ecbe323
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 21.8MB
        • SHA256 244ba99dd0401ab7c5d78a4d8ef3c05472f262c8fafcac77aaeee64471fc4af2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 21.6MB
        • SHA256 8069e822e3198c13eb0bbe2caea317761a435a16c5a4701cf9582df5fbeb5157
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 21.5MB
        • SHA256 02db514bb5acf81a30f67b6922f071481d90b5e7989863a5407ea3b71a1d7c92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 63.9MB
        • SHA256 7305d65db527b7b35b11a2b9cadb511fc4ead65c7a2890fa0753478beba2f7d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 62.3MB
        • SHA256 453b5594f3cac2ed26a2fad9a2eca1b114312b6cbb8f1c2e7af241ab37d5af77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 59.9MB
        • SHA256 d52cea673962ed698cbe01bcbd9178b5d77caadb408c48e8cd146c28609eca62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 59.1MB
        • SHA256 9c9bd38d7d6bf109e10ce7cb147871d9b273380f22ec020595087c8589461b70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5908-8-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/6140-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/6140-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download