Overview

overview

8

Static

static

3

2026-08-17...ar.exe

windows10-2004-x64

8

2026-08-17...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    26s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/08/2026, 01:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-17_ac0cc825dcdd3c2ad8ecb82507bfff19_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 32.0MB
  • Sample260817-cdarbs1emc
  • SHA256 b22c0d1947f1bee89b8eddb2b876a8b1156d6dce8a96a112409631c865fad2bc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_ac0cc825dcdd3c2ad8ecb82507bfff19_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-17_ac0cc825dcdd3c2ad8ecb82507bfff19_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3996
  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_ac0cc825dcdd3c2ad8ecb82507bfff19_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-17_ac0cc825dcdd3c2ad8ecb82507bfff19_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5032

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 32.3MB
        • SHA256 677ffe8ebc8914fe7cfe1937ca8351f6e7314fcbdc9bbeb09c70414b68d827cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 59.5MB
        • SHA256 0ae54d6727d5d06105909c6306f8e17869bf5456d31f08a0318e334fe5167d59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 61.2MB
        • SHA256 62f145034f6a1775ebe2657e5478157d4d591034c29861b20b24da3bf42e1302
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 60.7MB
        • SHA256 4f26e742817b39dae610942c10003363b2a5951807ddf79e5bbe1500579fbf4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 34.1MB
        • SHA256 60172beae6f0e0ea42a01ae860c34ad265e47d49f7113eaa53840f141614cc34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 54.5MB
        • SHA256 1c21b72d268f22da76f47640c4c642ba939aefeaf13508d300fc62eebba559bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 38.0MB
        • SHA256 69db2c74b865571e2cd3925792c1554ad64764ffbc03d7c043d5daeb17a3f4e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 50.9MB
        • SHA256 03c6270ec8158523c34f75ee46aa331d25930779fdc04fdfd8295d12e0939a8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 51.9MB
        • SHA256 c6dce88298f005a4325c7953bfe0619efeccc967f729f74a7ef666bce6f2303c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 45.9MB
        • SHA256 ae7d1942506e549e78367cedc3e4946cf6a4396bee6a3de5759b1fe5ae31c6c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 49.7MB
        • SHA256 ed8c93a12a1606fe8b50b0a185503c21309a9b4a4b4f3bc5fdcd4cdb31442d9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 48.6MB
        • SHA256 4915cdd2343021c8bc94c8facfbc3a899d3d2beaf9187b9be6cdaeebb7f70499
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 47.3MB
        • SHA256 33862b2127e3dee38c16cfc39bd601c260b734ba586ce5a682b22f6bec4f81db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 46.8MB
        • SHA256 dc335b2bbb8db10b590c4743f03d96eae4bfe4b9337269edf43ebc2d1b3491bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 46.4MB
        • SHA256 6594732657b7f9aff1c3a619a1b50990df97e859c4ca4bc8522a33a7afacc7e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 45.9MB
        • SHA256 fe29672dca593f990e537f3d5fe2a75a43cc88f80f72b9af5b8ac961302af8c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 45.7MB
        • SHA256 811305d5c7cbcd131cc8cb0db63a7b523102d08622db909f1bff5ea24c4bb0ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 45.5MB
        • SHA256 6ac4536e740628a81e1de05923af270c1088ff98f83b706869ec162a7526a375
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 45.2MB
        • SHA256 a024817a761c4244d14644f6b4d94fd99330978b2e06bc6fba203e0a26d1da57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 42.9MB
        • SHA256 f8c1fdc3f56521d259925137796fc24f9eb8ac4b54511913f280a7b9825aebf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 44.2MB
        • SHA256 ab55f81b03eec3d59731f8a51e66333655651d0392f1e21137dc63b3c72740a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 44.8MB
        • SHA256 1a572082fdf6f98d466ffa89b552e41a79a8725c53df3f15bda59e4c4f2a9e44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 44.7MB
        • SHA256 f4a512f4d4b9985cc026a93bbd364bcdf9193a658eeb6028839b0a8bba6a5c63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 41.7MB
        • SHA256 8f33d821af1f5bb4f32a3774e5328306e2aa84c82103d477f3f2cad29d0743cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 44.3MB
        • SHA256 3117d0ef307c6c572a12881872d138bb7a7869ee455867d1403ae3ed0681db6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 44.2MB
        • SHA256 c46c756f4eb5420e9ec7e46cace02258de22761913d7b380399ace336015c6fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 32.0MB
        • SHA256 be177c82854bdd1e7df8e1084df51e4d450bc4fa227dc323281533deddd194f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 43.6MB
        • SHA256 e8facc57da104304240d0dd7d4c5761ae8f3d36408adf5b6492b5b849a9886b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 38.6MB
        • SHA256 b966abe096f4e5ecd83baf79ecdbca97cc643e4c9f3ce7a42f7c991260e61943
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 41.5MB
        • SHA256 68e91bba3ac7aa2b541b8ce6481dbbf49ca3ef887dcb6d305838e11be02a8b61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 41.0MB
        • SHA256 cff0a0146b12aa3d3efd538b527e6672969a109a475c501a3bed63893675695e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 39.9MB
        • SHA256 fe57686ef70144a58c1733fb054b275e2a7344b91047f441533ea42a9a29c285
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 39.2MB
        • SHA256 38214619b483df98a9d21168e03dfddfbc3aae4e0ea1742aaecdde08af0c5e3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 38.3MB
        • SHA256 9282384f540ac0e3ce67d83a36e9fe67d7c7e1556e0420154a674530f3401bd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 38.1MB
        • SHA256 d4298ddf18e74c7b78d9ae8cc2965b079ef68e2a9075d864b4751c7bfeac707e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 37.3MB
        • SHA256 c3ec1e3f96183a72521e1bf1c3babf30363adb9dcba4051bbcf32b893712d7c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 37.2MB
        • SHA256 03c6e55fda1c85cf90fd5f93da8deb4fc93d0bf2b79b28d653248c3e2a814abf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 37.8MB
        • SHA256 4bad685f12235a07dee131bfa507e1d3cad15f50f4a8bafda95d4836503034ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 36.4MB
        • SHA256 d88e2091ddf2c5dabc46d0957d769089dd81bcfc76cb7a23bb72b1f147d58988
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 34.8MB
        • SHA256 fd5bb20cfdd1c41ef9ab19cd1e8b418fe2cca3ab1adfe6c917666bd10667b024
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 33.9MB
        • SHA256 a2c15579817ca835150654b5a1a2697b0f974d8c60171982c6491d8939fdba2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 32.8MB
        • SHA256 f10a7ef8ec0b0bc62b326c174b654772e43ff3079888b3bb8c00e4e2f63cb295
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 32.1MB
        • SHA256 8931d5711765b4724b6d9100dbbaf341350cd6689bb2d655caf20b5438ad97af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 31.8MB
        • SHA256 14ead69e81ce9c5a86526f0a61b23f5476bc038e5ddbff493a250ef237297911
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 55.1MB
        • SHA256 688c52bef2d454eee749947086ed3032a91217a0d6aa920bc4c60eec1bcf31d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 54.3MB
        • SHA256 72d546b3ca22972c04f17f0a4d8fcb5daf05a714b9f8ca08552fa367e9023416
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 52.6MB
        • SHA256 ac7d8d121964243be20ad8e7e21dc480460f98ab288b62c5c00d62c40bc4f0f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3996-18-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3996-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5032-36-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download