Overview

overview

8

Static

static

3

2026-08-13...ca.exe

windows10-2004-x64

8

2026-08-13...ca.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 03:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_c6164ac20693876908c038a3a6000860_akira_cobalt-strike_elex_emotet_hijackloader_icedid_luca.exe
  • Size 35.5MB
  • Sample260813-d41aca1brf
  • SHA256 e91d5db19c07329a06b49ddb46d7dce7742bc7439f2fa42ab815aa59bcae827f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_c6164ac20693876908c038a3a6000860_akira_cobalt-strike_elex_emotet_hijackloader_icedid_luca.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_c6164ac20693876908c038a3a6000860_akira_cobalt-strike_elex_emotet_hijackloader_icedid_luca.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5028
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_c6164ac20693876908c038a3a6000860_akira_cobalt-strike_elex_emotet_hijackloader_icedid_luca.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_c6164ac20693876908c038a3a6000860_akira_cobalt-strike_elex_emotet_hijackloader_icedid_luca.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5712

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CheckpointExit.exe
        • Path C:\Program Files\CheckpointExit.exe
        • Size 36.1MB
        • SHA256 5c03ec3b085d49f98f6074ec026e645fe18f47ff9d2d079eb23db68bed6ea9d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 35.8MB
        • SHA256 024dee3373213e5d717e0ad050e8f0ec4d0142ac25f5a50e145d1909d0aba11b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 39.6MB
        • SHA256 338fce5d25e4d4611f5a9e4acabd445a9652c76b3b5bd6aa9d834ebc4cb6e672
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 35.8MB
        • SHA256 6335ae2aad0fb7e254f26f9b7eaa7e15be12c1aeffa2c8e8420887cc9a61dbd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 37.6MB
        • SHA256 343344d52570db89c18dcaa838fc01f3abbb88939b327719849a510a6b93a800
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 71.1MB
        • SHA256 da55900d481dcbf68ebf5259f8496f64b23ddc2509d13ebdb4430d90fa8861a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 41.5MB
        • SHA256 9ee8b09add776d34c227d51731a966a626828874039bb7ce7f3548b392c22502
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 77.0MB
        • SHA256 6a9415450c530330e49589add772be41315670e091316b1a7ba5f742bce0909d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 37.2MB
        • SHA256 d07053762db100aa62203c3e4a8ff2d8a01f9e820da6ac1b2118470fcded3450
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 72.6MB
        • SHA256 96dc6ea1925865da631ba7acf60cb95d0e01c765fb4f7fef4d130418e4a4d580
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 72.8MB
        • SHA256 540458dc44f31b0907cd3aaecab7ef5e9d026b0c1b8f2097bd69f9e40807574b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 74.0MB
        • SHA256 e4c46bb6baed251b66cc41db18205902a2f03ec487f453868523daf0a20b4c86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 72.4MB
        • SHA256 818d51e943a17eca154f7ddd0e1b6e891e5e8e5df041cdcaf4dd6f916bcddccd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 71.0MB
        • SHA256 23293ea23d96f0a2c92cd9939c5fc3a5c9bd1618a3a9775ddfd6e0f43bc710a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 71.0MB
        • SHA256 aca40949ca7e594051c09f3066d08b3f491edcffd5cc56aa774a050f1051e365
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 71.0MB
        • SHA256 582ab5dcfaee9f0debeecf4983018133af42313764793b6290f8c26e729a976c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 71.0MB
        • SHA256 79616821fe41ebfe0b16021db3db468e4cd892ca0adddcf11330a59497e9fc6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 71.0MB
        • SHA256 c5ee873e0da7519558bddd1a92491374cd200c2997e125559be613c20a11271c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 71.0MB
        • SHA256 a54a18b590ab6fb88164d87ee373871bfefda9c1356ee90b81fb89ed48e365d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 71.0MB
        • SHA256 f7ecc6dd2547e62b28744e833458387376400aedcfcd27959b1bef0d2b13a21e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 71.0MB
        • SHA256 e7138c34ad087d62fa6a813e938d3eb7e3326859d470eb63fb8e8dba9032950e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 71.0MB
        • SHA256 4b43bf7fef912045d004d3c67b1d72f886de6ec3d726568f5c20463455d5ead3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 640KB
        • SHA256 8fe8c9833760a8bd2f527537fe17d0772f31ab61d2cd9bf30c370f983807b607
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 71.0MB
        • SHA256 fcfc2a2d0265ca8b9a9e3d8239de490fc39f00c7f7e1ec0d94f8a3ae2c191950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 71.0MB
        • SHA256 73e73ee4acb2fac48fa86c0fc65ee53af5ffe65524c352667f60aacbca342d85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 71.0MB
        • SHA256 73359e4997a75ad307138fd8a951bd7357ddd1495eb114f7626ce2f99eadab16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 71.0MB
        • SHA256 28124e7f8a69a9c8fb491a7a309a35de32bd1e1cfbf5a05cf982d13d7a3a834d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 71.0MB
        • SHA256 58475f8e3508a7f1b705fb4597b60f28056306eed19e4517475f42b1f73845ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 71.0MB
        • SHA256 8c0eeeebd6d9862ddb73588e173a7eec8ea71081bac9d6f9a6afb60b6f0e4c7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 71.1MB
        • SHA256 f0dff3f3863e48a7575bc98f0e40ccc33ab67032b406b5064af87c7a382da911
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 71.0MB
        • SHA256 57eba1599f471a1f3d55988523cff4f79a3e7207f504e30d0ba16d9e0f31c55c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 71.0MB
        • SHA256 20ec5d28dc862aa6c8ee0e46eeeb720d95bbb2802c8ce510fe41292236369682
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 71.0MB
        • SHA256 ac730dcb8ddceb8360ee6be6dbc18e9ea374f80e93de8268e303f44901a2e34b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5028-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5028-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5712-20-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download