Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 09:38

General

  • Target
    2026-08-16_e2dedd7543668bd196cc2cb2b2682f13_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
  • Size 5.3MB
  • Sample260816-ll2z8avbpg
  • SHA256 9641f1886b53a11ccf7651b651a083c6e57104cfdacf7a476f6c489605b769ab
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_e2dedd7543668bd196cc2cb2b2682f13_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_e2dedd7543668bd196cc2cb2b2682f13_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2164
  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_e2dedd7543668bd196cc2cb2b2682f13_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-16_e2dedd7543668bd196cc2cb2b2682f13_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4516

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe

        • Path C:\Program Files\7-Zip\7z.exe
        • Size 5.9MB
        • SHA256 23e26ffee0de62510b07f19a8e209b8d9aad7be3d26cbe95233cea8a5146fa6e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zFM.exe

        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 6.3MB
        • SHA256 415e4b682d3899b7701a482b42fe7f6ab3acc08cefa418d4e1cfd64310ccbe2d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 11.3MB
        • SHA256 64bcdd3eb031a164979001478034e36d4bca15900821f5c2cd5a56d077b68783
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 10.7MB
        • SHA256 268a2ed85896c6e514d59eec004dfc4a5fc71645e3f4eff336cec7205936d71a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 10.9MB
        • SHA256 d8559fda9edbf7800a390dd6ccf28b6e37b60686d559d1706c11b316b53dae8a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 10.7MB
        • SHA256 8924d58b1e97d7078abdec19429c0425a45bf6d53452381066e17d4981964621
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 14.7MB
        • SHA256 687cddcb47f1b3a2bb3754e1a755414388c2b1a5892cc009fbf3f659ffcc0ffe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 11.0MB
        • SHA256 0b5d953c1dc1de34e143243f458ccea54f0d197ec086488ed4fde2ddb63e7333
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 34.1MB
        • SHA256 a7d5e5363d9770d348307087fed619e1925ac15abb8363eae2f065077c8282bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 7.4MB
        • SHA256 214bd017d80ccfba54c1570569af4d3798526f6ca1182f3a0768e2f91bc0b1be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 10.7MB
        • SHA256 04706247370ec5bc2a0ac08a7ad774d78a1bd626c1f16a4d4f708aa4ad33e5c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 16.7MB
        • SHA256 eb89fa717566be1d34e52fd135aa330c1ffe0d1669b9e3d96354e55e851ca40a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 12.4MB
        • SHA256 e1d1642f6ec576c0ad2a0ead4f8190eb72f64401e7fb19605b9cea447ca6cb6b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 14.1MB
        • SHA256 2d5fad91b171bd8fe37f2e4cd0cc65cb446e3ce3673ae90a356d82f9e40a9af0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 12.9MB
        • SHA256 69e18425f09f87001c20766f6437e6c7f9ef2c346fa059bb9bf988e2c5fa06ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 12.3MB
        • SHA256 90af882a9774eedfd6151a5f402e60f71ca974b8c98ab947a362e5106f90f890
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 12.5MB
        • SHA256 c64493a78b9e13ddd35adbca3aa3fafa73311025d9a004d56779af520dfd4825
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 13.7MB
        • SHA256 0ad118d65e0884de85bc7a4a01532978309b6a0d77f3e0e35f3384a90a17f20a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 12.1MB
        • SHA256 2ef38ea0fef146440bcda5442a71e01c1fd21d9f15359c1963ba18ca99f839c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 10.7MB
        • SHA256 389d568ad022015fe8e947f0152070eb6c50be4f2ca0d44140bf24bc2fbfbbcc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 10.7MB
        • SHA256 3128af44040a76e1474e8bab1938810611db74e5b97934cc4fca67964cd531fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 10.7MB
        • SHA256 41dc03bd4a208617f7cf118bf520550194df1b901495f9612c6091f09c7fbcca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 10.7MB
        • SHA256 de25faf269e3a81dc70d9fa5a6eea51ddcc9faed6b82d537b448b45fe36c3ef3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 10.7MB
        • SHA256 d5ea7873c4a9a64400c095c7584f2d06b1549d422d9e23cc5460ea44ff0bad77
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 10.7MB
        • SHA256 f04c59a06be33d2b84ed9aeea67d7140e027ca10307aa55d4d030ecfe2ef84ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 10.7MB
        • SHA256 4fe58039b7fd1cf93c7946b174f1a884c0b3b1109888d253975bc79f6b9bfadb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 10.9MB
        • SHA256 df2191e852f34a27764d5d10ae93774e4aa9d6e2f818218e66006d7bebeb8155
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 10.7MB
        • SHA256 554ebb169326f0b1fc925fb087f3d5b0dfdd6eb41eaf5bcc220e0aa590cb89cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 10.7MB
        • SHA256 ed9eda5bce13603c5efb72958ccb4d743d8cbe3b5fcb106a940eecf59a626296
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 10.8MB
        • SHA256 851b41608197f2bd137e5d7558316cad7dffb2ddd66fa2b4bd0466b263407eae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 10.7MB
        • SHA256 904a73d087a2246403cb034b5ebb45e53ecc9798357e1017f43456aef074fc3a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 10.7MB
        • SHA256 6ea716dc3542c4437314bdf1446d5632ce2aec245ab7cc6c2d842c80ebefafe5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 10.8MB
        • SHA256 04a2d1d21bc9c38480d615cf556a035ef08b93fdc999c38826aa978f9d7df2cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 10.9MB
        • SHA256 4b6c618a9488386ce668da800d2c7e30695fa4a97c90d963d0ae8adf7fa5feac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 11.1MB
        • SHA256 1b328abd3c01b81cecbced8ccafccc66314e583ec2ee2e0432671bb7112d8c87
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 10.7MB
        • SHA256 00c43405f742bcbe76cf34c25fb3f18fe6064e898baa72ff3b92dae1093e625d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 10.7MB
        • SHA256 8f28be16ba80e69715fcafa6cb1e258ed555304a71b32e6fc3bebc798e98a26f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 10.7MB
        • SHA256 08eef314d828334fef0c70c771ce410dfd8287d11ef75d486653c628e222fe54
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 10.7MB
        • SHA256 ece3b11daafad07a8ca4545023df541e3c88134b2f292b2fa99dbf029e53e106
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 10.7MB
        • SHA256 39178cddb2ac73131ea7d092cc92eab0efd64e48c2d73a1436263ccfe4caf9e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 10.7MB
        • SHA256 1a866572b0cbb11bcae836663aa99e29973c449b28ab342d3ed43bcdc69226d8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 10.7MB
        • SHA256 19aba633d993bd115c4b905f784cfeb3fbaadd36396188a222e3ce02e1140035
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 10.7MB
        • SHA256 d7a9d39e79913b1f2928ef68f7bb0a6c9177ab7168deba731ca9937c67882220
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 10.7MB
        • SHA256 5a6d020e8995abbc7d2f9cfa357101d31501e8b1e32dd63404007819042c6efe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 10.7MB
        • SHA256 c80224d8e198ceb5f975f651fbd206a91cda3eb0cded1e41137f3fa77b25b322
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 10.7MB
        • SHA256 4b739a12c2edcf3fc2b4332e7643a79de992c5a7ac1dc61f85abb8d636ac8ad7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 10.7MB
        • SHA256 d6ab7cc8a6f52647d819da21bd513e16b6b2173b2710f996f53f7843d156fb38
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 10.7MB
        • SHA256 04e4765de217596e8c09d0f42a8964ca872a692cc735e225259dff13fcb15f3d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 10.7MB
        • SHA256 d8419da44d871db34de7fcc8ab4b2405f30bd01b0f52d038f84ebf178bdce746
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 10.7MB
        • SHA256 e5a5dbdd109cadf589f8aeab310ad4737196128ef3b9bd9800d52160014f6acd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 10.7MB
        • SHA256 caa7555afa72f7f78db492623bea04a2f26f1d47139144ad21f1d980c18c0ac0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 10.7MB
        • SHA256 b8f049bcb185ca5d03a6c5fbcde60ac6d128cce1c47ae359c1215fa80dd4f004
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 10.7MB
        • SHA256 6c4d756673b474f65b692e411b373627b268e9aac059487014ed0fba48ff0272
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 10.7MB
        • SHA256 ac58c087fa1849d982ae3fd087b6105e87b9a3e0a1dd0597443debea81fbd8fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 10.7MB
        • SHA256 597bfe6d051b7fa551ae197bd62117c64226bdd3566aa3850f2431f87155d037
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 10.7MB
        • SHA256 3e20a46f05a7f312532ebde9c2d8cfe6a85589e24836fdcaafc205020ec999ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 10.7MB
        • SHA256 f22fe7a3a4a6aba815c10dbc876b1c6ba7d0075465096294b524e6d504dc29ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 10.7MB
        • SHA256 2d19a28fccf29b8da0cb4049cc74059c3d1e50aab703f0121ced6374447a5e19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 10.7MB
        • SHA256 ec6d5cb63564c0f583e72e79f5355c063fe95435d6ec38dd2ab5815ec1d31d0b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 10.8MB
        • SHA256 78edd7202e92ad8fb882da556eff0ab0d3d24c88df782646669259b617c9b2c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 10.7MB
        • SHA256 9a2276253ca4f674651d5c597690a13b44f5f79d98337490a637dfb81771fd45
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 10.7MB
        • SHA256 02f71e247bfa053d45327cf07112b2cb96feaf13bfaa9f5cb24ddbc745f46717
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 10.7MB
        • SHA256 58b60eaa347d8b46331c6ea9ddcfc88290ce41cfe8dd2b306e28cb4b5bdb72a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/2164-0-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/2164-1-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/4516-2-0x0000000000400000-0x00000000004E4000-memory.dmp