Overview

overview

8

Static

static

3

2026-08-13...ar.exe

windows10-2004-x64

8

2026-08-13...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    57s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 10:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_212084f69c560072ff03eb78d924b41b_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
  • Size 49.0MB
  • Sample260813-mch2esab63
  • SHA256 715b57408c4514c2370bf07679ca9d05a88c18575d102866c2fc06b43af18f0b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_212084f69c560072ff03eb78d924b41b_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_212084f69c560072ff03eb78d924b41b_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1052
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_212084f69c560072ff03eb78d924b41b_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_212084f69c560072ff03eb78d924b41b_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2520

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 68.9MB
        • SHA256 b14753243656ddd3b5ff85d297aa7c837ab1692627af7310fcad97a90250970e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 65.6MB
        • SHA256 39fc2c5ed733f29b03fe321ac6d82411aa5c55d9fa5953fbaff08b43ed34db47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 64.5MB
        • SHA256 81d976f8c745aa1dd039a2449230420286220b7358b1e6d25831c008c7a33c4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 62.1MB
        • SHA256 b63f6245e7626b45df56da215344b00dc4573ad353e11b8b10bad8199d4e0e79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 58.7MB
        • SHA256 29fabfd10ef5de8f81c3dafa3562188432ea042ff32d24f94aac25467a07257e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 56.7MB
        • SHA256 aa0fabac00e0132a2630b4d263e46dbfbb2e24a9a7cc7c9470dbf15df4dee5de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 54.1MB
        • SHA256 6b9bf77822c2506aeaff75b96e0417a8fc04d2ce5a11ba1881060ce86c88a547
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 51.9MB
        • SHA256 ac9ad97fc45e026144557ce0840e298845760e3f6fde8f698170eea226ec804e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 50.6MB
        • SHA256 c0753cc3cbe84636339e67d514325cb407d3fc3f50060951c66185df0c527e4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 49.8MB
        • SHA256 e3071d09f74f9ddf2d7b4a440096e8dbcdfb478fe81bd329e0b5744159e9906a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 48.4MB
        • SHA256 ae6326136b246bed90171a8e9c552df5d2fa9f638fe5c78596cce0524d334e86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 48.8MB
        • SHA256 73c7518448ae6d3bedfef61e42a6b73cfaf247d89d860e3fc028ac7ad3658cc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 48.5MB
        • SHA256 e9b754dedd5afcde8cdd10e946eabbda8ff7ee9783791b1539fbc4b1f5e3faea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 46.9MB
        • SHA256 807becb5b88f3d4e3772003b73c6a3d8457df72f53549e2dba9ee1d759c4bc9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 46.6MB
        • SHA256 96d5f2711b9f142d44e234c07a20382388640ad0a33de7bc8053497d6c97243d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 45.9MB
        • SHA256 ea92c50c5fdf929fbf60d43e115cf24e0a77566a19d2cdb4158db1e98bb7ffdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 44.9MB
        • SHA256 385b354dcf8d11784119804678516e216d91f742bc1006273a8115a46206aaad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 44.2MB
        • SHA256 a70ff1e9cf0224b85a9578fe6e0b363e1b0c1c84c766e2d9cf6d24bbefb6ece4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 43.8MB
        • SHA256 9f07d19bb2568e8c6a6d9c18438e156da8edbfc5f704a4504af03c9abecaef76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 43.7MB
        • SHA256 87d7bf1092b037af84c0b7c2039586a325abb1f7478461039eee2a33eacc30b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 43.1MB
        • SHA256 5fde019f0172b8f5e881dc4ddfaaead4bd2c99253233d72539cdd3272a3ef803
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 42.7MB
        • SHA256 2293a19f641c101d9644dfdf65398b4928f24a90039cf6be89717b4c5363bcae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 42.0MB
        • SHA256 aa7d47a182eb3e1d45ab9a369120d9114aaa80d8af5f1032b9beb433142a8b62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 41.3MB
        • SHA256 cbe8b921b0ff2463a38aed0c22fdfcb40b416d375f537e8d462e235f93267a57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 39.8MB
        • SHA256 f42732b2f5269ccc984f58d76c2619d9f87df719cf03339ff8d0095861a2f753
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 38.1MB
        • SHA256 248b4938ddacb9069365b9e660f5b9ac4052162af541f8fc179a701f863eadb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 37.8MB
        • SHA256 a545c112379b42154f11906bb26e0c88668cef6091b11dae4443fbd0b011ca72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 36.6MB
        • SHA256 14979880cb0d4f666dc253c1cc1f283785215df8fd00f107bbaa743c46fdf1e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 35.5MB
        • SHA256 f7f9eed7b684f974b5a70b9848e5caa8e5d62c8534a6e4d313f98d60bac0ccaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 32.0MB
        • SHA256 b7eb8786c7ca8965ba8fef82b2b84642012458bff6b2d2bdc084bad64330811a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 34.1MB
        • SHA256 45ea8202d21d0a4361a9699e08b1edf449938a1c9ca1bc9a0b7bfa538bd463b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 33.8MB
        • SHA256 f46f53ef1d21b4489c2dfc04d7c92079897d5063bdc759db171a4a91e6ced8fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 32.3MB
        • SHA256 07611ad75309698c5ad2084c6e51ba3f03b15298047bbde187838a5732949276
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 31.4MB
        • SHA256 9c25f51cfb621c0ab0c46776b0e2bc671e98cdf66033779e70f23d34681b4623
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.3MB
        • SHA256 b50a42e16d0de009d1558aeb2d9606cc99f0f546dc6361ae0dc79fbcf8afc88f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 28.4MB
        • SHA256 0867f8b3f85d5c41eb07994d3c7cf95dad16719a2ac5742f6f67d4b407621f8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 27.4MB
        • SHA256 91ee6065e39d298e2538a023a9118bb0495928725ccbd431c09ab655135f4542
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 27.0MB
        • SHA256 1a694a44eef0e3d57a51609294ab12bc1d652cae65272fa3541708db416e2748
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 26.8MB
        • SHA256 f50854369388fa2d27dce8138aece1aa75d952731bfcb3ef1bf16a14511f0c69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 26.3MB
        • SHA256 7ca7ba77f2d19a14089bf6517fc74332c29555221a0a9490fa70de1e3e9c2272
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 25.8MB
        • SHA256 e381ed55266c3959ad60eeb393ce4ce56c6c1a1c1fcd5ede3aec8cf6722b545d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 24.6MB
        • SHA256 1dc945d295a1b0419cfb29ed9f5c7431cae69cbde29474346938a9de09306529
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 23.8MB
        • SHA256 50b50e1c11876375a3947eb9156e4fc15fb3b3c05d9dfc6c9b42c568ed0227df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 49.1MB
        • SHA256 ee8fc21e4b464809031a0a2d9ac709aa6c51ee7a9e78015903a3b6857ea429f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 98.1MB
        • SHA256 ff1f0440eef5623eb057b117d18069c14ba564f230f0bb562eafe08fc728025d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 98.1MB
        • SHA256 48c9ee0b53cda14fe20c0963ac77a3cf6cb34c380eb552d1cd88b5e61aba2d7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1052-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1052-13-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2520-26-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download