Analysis

  • max time kernel
    150s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 13:29

General

  • Target
    2026-08-16_a7afdaab44c2d82f3db4223f1e42bb1e_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
  • Size 5.6MB
  • Sample260816-qq82jsbr2x
  • SHA256 b2ecac1f5fddafea7c62109757f659804fb1ac296934027adc93c192d24028f7
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_a7afdaab44c2d82f3db4223f1e42bb1e_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_a7afdaab44c2d82f3db4223f1e42bb1e_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4980
  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_a7afdaab44c2d82f3db4223f1e42bb1e_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-16_a7afdaab44c2d82f3db4223f1e42bb1e_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3820

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 11.5MB
        • SHA256 be98bcf4912f871fa07ce5d3853e10fed4890eb9b1c5b8e253db7779524bbc73
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 11.2MB
        • SHA256 ef3bb031c5386377078f5c4256ff8dcb5e76ea9fb24e1a9418dc89f9c8f67c70
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 11.5MB
        • SHA256 ec2dd418dc0d864ac066b4152a07eed59de9f7d9ffc3b39a807985b8751480c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 34.7MB
        • SHA256 23d4d5881317e6f6b2e7902b4df02a7af3c6a7873cf0ae722e2d3a55a46ef502
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 7.7MB
        • SHA256 c56b4e28df1aa858ac427eedee0de9279b692f938a399476a70fcd1878f2faee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 11.3MB
        • SHA256 3cdbac39cf2b491faf626697e6d6737df30593746c09b00330da97290adcd9ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        setup.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 17.3MB
        • SHA256 25185b734fea973cbb9ba77663346264f7cde6941c2505fcda79aff0911f4f53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 12.9MB
        • SHA256 c0088b97c8e5cbfbf7721ad0484d93a3f0b62b8eef30fcab8a0f42311ffa9a29
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 14.7MB
        • SHA256 65a13d049ea88af8b71540bec11b0a848874533a23a074032c139ffdc4984b1d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 13.5MB
        • SHA256 e9c7040eeb59badeed00a231dbd262ae200d962f5f05e25dd8d4d5be8d6c9fb8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 12.8MB
        • SHA256 78f2c090fd9dba5e0039472fd3caf549e958167d665e7a52f561a4a2397367a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 13.0MB
        • SHA256 1d4b2a74d329d69e5833af4435409708fb408e964e41bda463a9089508b898ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 14.3MB
        • SHA256 1f29978061d65fbf43ef7aed34d945f3426fb06a63c23306f8451a1df05c5f74
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 12.6MB
        • SHA256 8ef7b26a3fb27686605c6cbe1024ddeacb6fc3f3aac1b675e675807314906e1d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 11.2MB
        • SHA256 6520d279acc9ebc8efa1b155cdefe71699a707ec492a5f4be798443eaaf2d478
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 11.2MB
        • SHA256 311661c20a59a37a4ca0b0606b5af6e575b716a8e63b8161d746e565831763ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 11.2MB
        • SHA256 9bde14687a39fe23be164533d13cc5b6ba9a68afde887e21f1a830cd5c185b23
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 11.2MB
        • SHA256 6fa3aea032f965a432bb78aa2054403cf7cfd1fd0e2ec796d60714b3b097e7b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 11.2MB
        • SHA256 b838213158b9bf86edb59696468c6102f13a877de343708023c9c6b797e2422b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 11.2MB
        • SHA256 a08757d82a1d8b1f6b28507ecc0ace5789a44fea1ff45101cc310ad666deccbb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 11.2MB
        • SHA256 71490a18ccdbcc951a2fcf943844a57a8999fc3899d108346fc6f466765334f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 11.5MB
        • SHA256 b1468215b97f69d377412e2146f48aa7b372db4119d7158c0a8445f2f4c810a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 11.2MB
        • SHA256 4e3a3470c6c9cb736b149dcfa028956aea83440d1f342ea8a319215098515858
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 11.2MB
        • SHA256 db420664a15e9f03cd065079c598bcb56e87484b90894d416c0f15d02a74a650
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 11.4MB
        • SHA256 40426b27925d09a5d572c1efa53f166b6507b3fc151073cca68efc28a586f922
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 11.2MB
        • SHA256 01467f84c17a505bff9561b2f7ced4754b1cde4f9b435706b4ce753ac5ea2e94
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 11.2MB
        • SHA256 06f4691cfc5d128d0610cdbe781d3d0ca0d0ba59441f84d357056db93a67ce74
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 11.4MB
        • SHA256 0742b83b1eff3c95c05870fb221d31f0f3fd87e0be93dd8f57569c91a763e840
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 11.5MB
        • SHA256 ba4b95a94183931d9c4bde301f66ad5472ed702d30c240135466ce8714c3db0a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 11.7MB
        • SHA256 3cbb65ca91d0c530e431ce5e1b956f6c3508d0df8d7d36714b727f5e6056c42e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 11.2MB
        • SHA256 7d5cc8af78804f7ce5cd52139eda56eedf6f446e40f379ffbd808697d93fcaa7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 11.2MB
        • SHA256 0a198a5d8c038cef02f4d28b08f6c406ce29bb2ecdeadb04c165f18b2596df53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 11.2MB
        • SHA256 88217baf469f5ed718575eefa5868e8d737ffdfa88c3b64876eb13b91d7beee0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 11.2MB
        • SHA256 06479fe2b76386fa20ed3fc984f02db75ddd295e5f21821cf82dc6aea623a61b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 11.2MB
        • SHA256 77148be10370f30c6ee1465386bc036f3f6607445aecc8ada5eee3f1b2ba5996
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 11.2MB
        • SHA256 18506bd29a3539c02b0351f95b5316f1a1f8496d0746a259b138d1a058b94744
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 11.2MB
        • SHA256 2e7767f82010afc5f85d4e906357358bf3da91db20749504c6871c0ee7801667
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 11.2MB
        • SHA256 d1da7e9cf73617d0c2ba9aca6b6d53c79b0d083be67c787d6c62439733cab515
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 11.2MB
        • SHA256 6a01b55ca6f84f4ae3cf0535dd300bc9c89e4bbbe27e9a443c1942fc0e654d09
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 11.2MB
        • SHA256 3dc268fdac9cb42e52fd6aa171cb445df739e18705dd35f554d0a67ae0ac4d5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 11.2MB
        • SHA256 a6b9c69cbcca27984df11637e0af9121b290df2b11cf3d2aeefcfdacb34bc5d8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 11.2MB
        • SHA256 1914d01002bea5747dc815a608c7d0ace2f819262cc6b26566039bb869e53997
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 11.2MB
        • SHA256 201b8b862fe048d55f2bf653567d5f882993011767c0e48373b52217f4f3c475
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 11.2MB
        • SHA256 a4c2b8a56ddc491a046ac5dfd872930b8f3a9b6a48c419db58d32b4d79c05324
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 11.2MB
        • SHA256 f8a7b0eac7b542d21d0b6adfb88644e2bd4df6873ad4ad00e3a8f7e4ae3e90a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 11.2MB
        • SHA256 3888f10711a01641b4bff196d9477816d5a3f8d43136abb74e4745528c503037
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 11.2MB
        • SHA256 ba7f4d3266885dbb28518e512743b263868d466fdbfaa74f2a0bdf1a6eb1bc21
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 11.2MB
        • SHA256 67346d546f68c0f07eeca3c62d00566a2efd53298ec3bb4a3215c01b339b81ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 11.2MB
        • SHA256 dcd35a0a9979f84943e9ec138d9e079032c26b67322784ea5b7fdec1179fa45c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 11.2MB
        • SHA256 110304959d4855cd56362a76a5ca4723a935ea8bf877628ecb604aee96426200
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 11.2MB
        • SHA256 1089e8ed210cdac0170f8964fb0e1a9c6c60c35470c2182f2ff9019f2d53df77
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 11.2MB
        • SHA256 7a1a4fca062975c994a4e8436212ffd01f8ffa4bc85d4ea640d1ffe287d21e18
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 11.2MB
        • SHA256 c64cbe323b0c424fce18db0a5eba94db1a19575948678887988d10c60bd0e857
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 11.2MB
        • SHA256 aa5bad53ca8a5af52cfb06cfc8f64417ebccbc006ed85a421e22b5662082c557
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 11.2MB
        • SHA256 41b4dd808a1c6ef145d8dc6aae13525c4e2de3c1d4a3e2938fd94bcbe3221c3b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 11.2MB
        • SHA256 97d85e151888c5fe1e0006cb1174d18f418aceb752ccfe9498d49f1b76e1c8cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 11.2MB
        • SHA256 f6e5ca5f31aeab961c2877034a471ef46580fd22c52e6ffe959d0ef03324dab9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 11.2MB
        • SHA256 1f2303af716a6a98868774924fa74ece0acb64581379e15d8a5a4f7fc434bc7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tnameserv.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 11.2MB
        • SHA256 ca44131042fd961fa8fa6cda729c9e937000e673cd25fc22ddccef60ee3255ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 11.3MB
        • SHA256 6fca754c04e19c7765be4e62bcee1ecfb453cb56f15c2167eded3c27aa01b6eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 11.3MB
        • SHA256 4e05fd63b86e5811aab26ebd0f0247fa8e640e6ce24e0391e985c1d2ed93e1bc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 5.7MB
        • SHA256 a8dd450a68bf5cc4959e18fca36835fc0d33ad3fd869774798052df5ff735a96
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 11.3MB
        • SHA256 1ffcdf60f6896dfb670d2573561403093212848ba03871530d92c8ab4fb35a87
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/3820-2-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/4980-0-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/4980-1-0x0000000000400000-0x00000000004E4000-memory.dmp