Overview

overview

8

Static

static

3

2026-08-17...ar.exe

windows10-2004-x64

8

2026-08-17...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/08/2026, 21:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-17_847eac29a5ab1fdf71b0ad8389061c8f_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 13.2MB
  • Sample260817-1rtncsdh74
  • SHA256 78371830368f0e5755d649a247cb2fbf3061611e4c6cb57dafcdc05bf47d2c0e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_847eac29a5ab1fdf71b0ad8389061c8f_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-17_847eac29a5ab1fdf71b0ad8389061c8f_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:460
  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_847eac29a5ab1fdf71b0ad8389061c8f_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-17_847eac29a5ab1fdf71b0ad8389061c8f_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4520

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 13.2MB
        • SHA256 78371830368f0e5755d649a247cb2fbf3061611e4c6cb57dafcdc05bf47d2c0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 26.5MB
        • SHA256 37a9c3bf1892655fe450e213e08f6c83193be10f27e4b65de5a9f2c0bc6927e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 17.3MB
        • SHA256 eb9a0a4986eafda6866e0d6d05271d0adb1c85717d52a6ed4ae86ac38ea0e37f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 13.6MB
        • SHA256 f4fff3f9c5bbca1c7f50d7e9290e56d6e1c76ebc013c157fda2d0cc72544156b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 36.7MB
        • SHA256 12a683f309c55d3fba7720247756bc890ae5cc5b44f3218c0cdf09db5d89b732
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.3MB
        • SHA256 452122307f137e5fed89b6e2c7199d5830d2f4fb18783135991d6e4f13b18045
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 26.5MB
        • SHA256 5b24b977b50b6c791522c8ce07dfdc753933adc48f9e418aea23c08ca909aab7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CompleteGet.exe
        • Path C:\Program Files\CompleteGet.exe
        • Size 26.6MB
        • SHA256 39b394177a9e1423db5a27a3a3fbf0cd3712c234469f9ba4a4d6c9ca85ade91d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 32.5MB
        • SHA256 f8fd4d9c05f0619cb5215cc877f6d79a23c468862da799c5a1bff1bd37ecc385
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 28.1MB
        • SHA256 c17faf8f31c4184b403b7a40a580036d736b19795d73c90c3cbf0e53d939a7ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 29.9MB
        • SHA256 a9fea7f82f05c738ea6f97c1dfee3758d98371683ae5a8af10ef6326b214559b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 28.7MB
        • SHA256 0a778396b4d7de5fc05b54c6f4d41277a3bedacfcf2bf2ef9a1ac761a9320063
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 28.0MB
        • SHA256 2b5dd72a186e05fd74db104b9f12b0cec333351bb8828fa419be3679ee501e06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 28.3MB
        • SHA256 9e37979d55c16f95365d3ee037bb33394c8eff96ab4e22e51a52bb8f0bd8ef3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 27.8MB
        • SHA256 1b1dd25f18b7e2657884a78dd8b67a9ce79bb2c256b6d373aae88c4f8516048a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 26.4MB
        • SHA256 4b57fd2450e48780c91cffae0de5cc232cd836eb9c06d622c07310a539d0de2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 26.5MB
        • SHA256 f1531ba778c78d6f270f1e3f340452b25310cdac576914bc097da8b4b6a73d59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 26.4MB
        • SHA256 e95061c92dee271182fa3342780ba7c10357257441832a2e29537aea17d1944e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 26.4MB
        • SHA256 3864113d87b051db29a16a638384b190deabb245205d686aa937f65cddbdaa90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 26.7MB
        • SHA256 b6f8fd07e3abd211a6da0c7420f8a71312927f40a390da8417059632a36b1d5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 26.4MB
        • SHA256 5a6b8a44053707dd096bec55d547bb29d9d6e8caf20c389c57d3a67275d1bba1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 26.4MB
        • SHA256 73ecaccd3d3c3051727e9f5b0bc91c71b280779d87b3963813b056a025f5d409
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 26.4MB
        • SHA256 5467c501d83c5dccc1f8a9d0dcc8ff059a070d3b8a0c9b7319d065935298e7b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 26.6MB
        • SHA256 32bba2adf02a69ee124f46c01845d20ad00db9efd0200f3b619ba717d975f60d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 26.7MB
        • SHA256 187f17a5bf7cf964ef3da4af8ad914bddc028240e35119f25130e0b4ce76aeba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 26.9MB
        • SHA256 3dedcc62e76b2ff45a5ab321310eb3379e6e26a43134f8b99bcfdd41c06bb8a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 26.4MB
        • SHA256 58f6361072313346f26f5b2b9e719ae11554dffc9f27472558fe301623780ef4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 26.4MB
        • SHA256 f9bc1ed342e02dd2cbabed7b641534dc7f96cccfd666e768d013b3a6398be1c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 26.4MB
        • SHA256 97ab35877b559f4ac0599438e1a65b0a4d682dcaf7d1118863f1d3723bd201f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 26.4MB
        • SHA256 088cec6b8861f804a8d60ebcacf65f7889e7999370caabedfa4dbe609e568612
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 26.4MB
        • SHA256 0a7ee874f62167c6670ae4f34aceaa3b8b3662f519f4ee0d6caba6cc9d7acdb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 26.4MB
        • SHA256 a9e47dd7cb06b78b8d05dd2d4931ce6af74db0f9979789a30abd9707d8e2b0c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 26.4MB
        • SHA256 8849ebc3d098cf7260c9a74afef8c6a17915aee529d1653889be2f91222b57f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 26.4MB
        • SHA256 df8c1477a61340f0e3e7360d6607e9899e02dc905b4af2918c1e049a50c1b869
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 26.4MB
        • SHA256 421ae2049fddfd1a100ad5da071ed2163ce33a20807a82b3630be55a5286eaa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 26.4MB
        • SHA256 5ddcaceaba05debabbd8d5aa590290be3d58c3382ae4e6f7654d53557cb2f9a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.4MB
        • SHA256 34c1b26d712ea03dd72bc64edeaff8dd32a5183bba56e431ea1a169d8851d60b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 26.4MB
        • SHA256 6c9aaec8be4b787035d5cb6ac4418bc10c14a6472826407d0f47951ce00ac7b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 26.4MB
        • SHA256 10302095cae6ad66d40f7eb4821dfe9eab1facc6d61a52b7c1ad60fdfde9fc1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 26.4MB
        • SHA256 66025f40f51cc308d6793e338b7f3ac64375d7c40f000a1566c8e5b61ca7848b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 26.4MB
        • SHA256 0a84b90a6bfd48a59998cf15a9d5eb9f453bc4de02bf63cea947d26b6a478af1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 26.4MB
        • SHA256 d22a57740feb54e7a3b1acce9aa057812eb46421962441fb49db8996b6977a8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 26.4MB
        • SHA256 2a8ab4aed1f4c93fc74bf8a4253e7f0dfd693050ea33ed8d1859ca8f177df458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 192KB
        • SHA256 cc71df767f30aa32b4d730d3c0244896e3d45eb216f18568c46371d93640cac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 26.4MB
        • SHA256 440f34b7e2fc9c9f471f5b7ce98be0e25ae1a686e64d158ef4a49ef93037228b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 26.4MB
        • SHA256 ec269ec0c06a7ab229cbc7bb946b561312eb2c277b842b1877d86f8f1398b83b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 26.4MB
        • SHA256 98d0668e3e12cbe1997c2a23bd0c3870f5b77f10f72079ba2f7d835771b5ccbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 26.4MB
        • SHA256 7c6f97795437f40c61cc680b55e2efa4ba539024f1a3d2e75386cbe30f8a0346
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 26.4MB
        • SHA256 2bbdbf9d1278cafe57a654e0f15d258cee4e103dfffaca7c4c47e656f67b34ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 26.4MB
        • SHA256 9c413c5a8229ba3772e86f1ae0c44180ba8b33e7ecc6a9f13fb7dacd436d6fa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 26.6MB
        • SHA256 5e498eb7a832bdc8f99314b24b3cef6f09cb82d36f637a20a9cefe6f38c56706
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 26.5MB
        • SHA256 1872ba92a6e61f70db04f87100ad7e098869dca5dceb6eb324cdeaafef59b92a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 26.5MB
        • SHA256 08b1198f14c1fc89eb0ce34a099aea79e7d7eb8ce0959c67c2f7ceb1395becaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 26.5MB
        • SHA256 08ccf22ccc67de0ba47d2942e8a9585393edf18e7c4acc1b3489e0826e8326c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/460-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/460-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4520-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download