Overview

overview

8

Static

static

3

2026-08-01...ar.exe

windows10-2004-x64

8

2026-08-01...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    117s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 00:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_a1306bfa4c6f514d169eeaaf7fc4adee_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 10.0MB
  • Sample260802-afcbtszfjd
  • SHA256 0e2cc70e2105e9045af50ce80b47fab0e5dfc97d5cec571d336fdff72b2f1069
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_a1306bfa4c6f514d169eeaaf7fc4adee_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_a1306bfa4c6f514d169eeaaf7fc4adee_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4128
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_a1306bfa4c6f514d169eeaaf7fc4adee_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_a1306bfa4c6f514d169eeaaf7fc4adee_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4332

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 10.0MB
        • SHA256 0e2cc70e2105e9045af50ce80b47fab0e5dfc97d5cec571d336fdff72b2f1069
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 20.0MB
        • SHA256 4bb1eb010ae9b7dbc7c36c70edda9a58c3b955f8a0a713bddbdb4781d5bb07aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 24.1MB
        • SHA256 0c0ff864ae4cf292950da5c247bdb7a8e3fb055d886fbac64dffc5add999310b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 43.5MB
        • SHA256 35ed55a60bc2aeab81f9eefdbbd273f9f56879f85b49c6408185beede9494291
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 12.1MB
        • SHA256 364d8146615b1750a1d6f79bec04c626b8ffdf1d2b7b303628c89a535f69f6d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 20.1MB
        • SHA256 b7c18f91cc766d6e934f93fb7cf3d76071e30de2a53d6d049e33129bb873c17c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 26.1MB
        • SHA256 9bb258a77fefab94f3827f43f353da3e8fe82e5485ec009e54b2059d34569758
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 21.7MB
        • SHA256 35ab5f75f3af6f501b474ae89c5738e6b4618cb31fbcacec8134bed85df86465
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 23.5MB
        • SHA256 84eafe58f0300982ad08f761dad9f7e17bde60e89c35e366a0000ced6e5c1023
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 22.3MB
        • SHA256 d21204a0fe74e663b334f05b93d0d7ddbe15a181874dff1e721245e5f2485350
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 320KB
        • SHA256 363d8bcebbc5b12363d0170b74c75e244be34429994cda946f54b9498c281b27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 21.9MB
        • SHA256 4fbb96d6a61b1c9e9d12f823a3d1116961123ae2fcdbafcede21564b9a40af30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 23.1MB
        • SHA256 bdcef582b1fd0e1e620a7730b7b598df8bae256400cdd1d90aebf76fca032e63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 21.4MB
        • SHA256 6afe727ee9edd95000f1e91b77a496f6666733a141aca844fb1fcf400be3cc24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 20.0MB
        • SHA256 009020d64c00faa978891754cccfe320ec0d658a898da556e975e156fc4bdac0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 20.0MB
        • SHA256 95e78afff27c1127dd7f60eed271d67713666de215874ce1c2afa7e05e4ee87d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 20.0MB
        • SHA256 159a7bf01519e47f36c61c9517a8106aec7845746075a762a6d1481be6cec8bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 20.0MB
        • SHA256 5be274a1fdee828f015ceb7d9643feceaaea210a3f6c92d21a6824615962bdd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 20.0MB
        • SHA256 a22719a9fe975271cfd3aaa045bc1cd9bbe0be19d7291955abb2308abe74b78a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 20.0MB
        • SHA256 77c2121de8261d834852a1a1ed69f6e6895f8f1da3ed036fbd45bf8956fda907
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 20.0MB
        • SHA256 ceee406389e3600de5d24cbfb200c8fd62f47ea1441c559abd9ae1e939cfc16d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 20.3MB
        • SHA256 3ce869bc6c8c29329161dd0be59a6a8e2b998fc8d480c6b4801a827766e00754
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 20.0MB
        • SHA256 99fc8d1fe1a57e631a3edaa7fa24ce6d0647c535e7feb21c74e95e2b644ef89c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 20.0MB
        • SHA256 5317dec4cfaa6bc1fe77bfe336ea4dd6ce8c77549f731bf27a41239edf2cf80e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 20.2MB
        • SHA256 ce9430adb6a3d3907ede4e7c7ed1d8710e0af5e21887c1e1a2d80fe30e20f061
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 20.0MB
        • SHA256 ecc7e253a2556a4adb92a2f93ccc4cc936dad21b4ec35626a1be6f8c1a4c009a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 20.2MB
        • SHA256 5cb49150e2768a67d4aabd0919975911c72043d3e933da6facef0af9d9d6ec5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 20.3MB
        • SHA256 2c56433d38c1cdde20f7ae55bf9563bbe611471c7b92037ee3a8d3690468ffaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 20.5MB
        • SHA256 b38330c6090e028a37c413202da01ec495317d1f87da87980fbca9d55b73ec63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 20.0MB
        • SHA256 be3d7697630584b3f4f33cea2727c04df19ace95b8afbe4a20dd02edb83d3440
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 20.0MB
        • SHA256 250eab1edbead65e845bfae4bc50bcd3c812bb1068e97927a0bbafcc31d77358
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 20.0MB
        • SHA256 f0d039710d38b6b4617f9fc937cac135126b8a9e7cab16d48921fe766d4efa30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 20.0MB
        • SHA256 66154356d06a5849f6f7bf58267b134e42c4333cb576eefe8e4cedbfdf08cd27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 20.0MB
        • SHA256 85f763a202039458a6a256c090d6d002aa75ae6b70e30c1006736776c8cc416d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 20.0MB
        • SHA256 92a252d3bcf4949014dfca0cfa1e89a8177d79dcb92873a237cb8c8206dcff85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 20.0MB
        • SHA256 5e7c059bf349bf11ec484b036de0c4b6638c229f38aeef04a99a41188065a059
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 20.0MB
        • SHA256 d9679f1c504afe100f06701974f114866f5c8def5ff968b5a439e59178073f7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 20.0MB
        • SHA256 c653d2fb76dac57f0a4e81fd12343e2f97e5d96c42f758bfb1a28b2f288b1b17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 20.0MB
        • SHA256 c0a16a48ed00761426462534edc765baa87efe1e279697934e96285f6a53d5e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 20.0MB
        • SHA256 669465a35318f135186e10c1a9409ea9b9c4e84c217289bca523ccdb9eade1d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 20.0MB
        • SHA256 cd4db56ab385f61f52642a516c165303af59ece3a64663aa5ac58426900716d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 20.0MB
        • SHA256 e9f54ad04ae191db5a51ac9b2bca3278f9c246c5f0156de1d4a00d3cececb7ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 20.0MB
        • SHA256 a5226f8cb5f078b13a61271885a7505eacb90017b352ff9b96da277c503baa02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 20.0MB
        • SHA256 2cb4beeb8cfeaa0e87e5f01882e95cf0961fa1d6d2b2daaad11c8e585d29f981
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 20.0MB
        • SHA256 b92faf9152cf3f153e025982b28f36a39d65905394d74c5c21f6c027070e3c38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 20.0MB
        • SHA256 dbe13bef0df78ed7e0406234334a4e4a342782b42a87e6c2275feea542efb86f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 20.0MB
        • SHA256 1bff6bd23cdc65fae6543d8de2f15a708618e57dc37db57bd1f13a1cf6eea819
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 20.0MB
        • SHA256 5ff1ac87debe1786a786bf87d7153e2924cbb7c483bbae39a7aa733663491d92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 20.0MB
        • SHA256 0a65c68e00e58fc50278ac97f60d59363705d39b36474b4e2725ddca8685f704
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 20.0MB
        • SHA256 4615904aa6a9bf8ea0b9722a17d45a09ef39db2a409dc269c1393005b798fb35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 20.0MB
        • SHA256 0b974f12a8b0f2d8befc5d6ea6d9b3eeba537e41e2dc0c4fca9d43d9db82f046
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 20.0MB
        • SHA256 81a099cc519eb315db8514b567c863557578c3b21a5658921cb9e29540c0dea4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 20.0MB
        • SHA256 3fafdfe87501ba948bd57a94c08157bbd17ec138e4fe3b112f808172a3ec9f64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 20.0MB
        • SHA256 913ebe8cfed6ed29692906be69b2b9f5462b43bf07fda2aee5dec0b2891f7a66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 20.0MB
        • SHA256 b259ec427b4784decd6e931b82474421b69ad0ce6c69b3a2756f898407ba2ed0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 20.0MB
        • SHA256 d72634e4071f3867d7ba876f2e73320fc93ed3ba497988c414d1dd773cecd023
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 20.0MB
        • SHA256 e7b493b8047f8da0ba0ae212af7a9764368b2e50b4566a71ea6f8bd0d80abdf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 20.1MB
        • SHA256 2a768cf2af493c18a5fde8e2b63657f63749832cdc16a4fcbfbcb0968569572f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 20.1MB
        • SHA256 8ca45f78c1f4fb9319b64232b5fd523db1b04c178aabcf70957eb5379476f90a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 20.1MB
        • SHA256 24d09816ee1a455d22bddc5fa296298f535952b946c90626765545651735074a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 20.1MB
        • SHA256 9f0364d856763d6841e468e4e60d39fd3e3d57850b294da9c1e0444669a0b1bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download