Overview

overview

8

Static

static

3

2026-08-17...ar.exe

windows10-2004-x64

8

2026-08-17...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    24s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/08/2026, 02:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-17_4f77aa0a8b0ce49392307a0a09318592_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 26.2MB
  • Sample260817-cqh88sdn21
  • SHA256 b5dbfffc5cbf4e0d9bb40b229cf3299926e734608054bb945b134434980dcc23
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_4f77aa0a8b0ce49392307a0a09318592_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-17_4f77aa0a8b0ce49392307a0a09318592_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5340
  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_4f77aa0a8b0ce49392307a0a09318592_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-17_4f77aa0a8b0ce49392307a0a09318592_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4756

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 28.4MB
        • SHA256 c57513e05c2fc2e004935766833f05476ccdb96e31cfa2aef7ff7e7d7e12bf08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 52.6MB
        • SHA256 5c6e57635e67b8af321706b38b957ab7d5b462141563abd4a5609aeb3df7f41b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GetConvert.htm
        • Path C:\Program Files\GetConvert.htm
        • Size 53.7MB
        • SHA256 1cc24b00dcadd0afc938ae52c14fe6279c04cf325802ce9c837774f1f7b24ae3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 49.1MB
        • SHA256 dbd5a72dab0f9eee8f8b663d06d7af45aca485f5e5708a5bcf8a3a5f2e6cd8f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 51.8MB
        • SHA256 687b14f12e2ed425cc451b7040b8634da04181c6db4e249ceb519f150949258e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 54.2MB
        • SHA256 d17ce3ab905041e03ee13a21933afc2425a6411b2a69c537af1b18d15d765aa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 54.8MB
        • SHA256 bd0e1bf457bbf9154611979498977d2713e191eed7be3452f69a781d484d4c25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 48.6MB
        • SHA256 472a7675a02a8fae64296d96320ecfc92b472d8e565f4551856677a91d74ccc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 51.2MB
        • SHA256 afc40f7097a294d3d283405c07347f176c4eca5cf37ea0e3522befb46204efa6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 50.9MB
        • SHA256 809bc3978f5605fe092a58096f93e53dbdc4ebd88786fdadda3305df6fee7773
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 50.1MB
        • SHA256 d4e76bb5eedd4903cecdc67b2790844baae2c3ea151f486c710c75e5ba5a25c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 43.4MB
        • SHA256 5e368d734527aed1e3f191161ed0f4d98868cffe1bb54f1ab13ab5ea4ac179ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 46.1MB
        • SHA256 6cf7d195592bb68232689e8c49df082ceccadc390653b2b9cf0d6c76bcb985be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 40.8MB
        • SHA256 467b030002f765550a41e8236764bd3816f932cd5f50c988499a76fe26455c41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 45.6MB
        • SHA256 7a1c79bb78ae9c1eb774fcf4abec398de787a2b81d1cce12ee81e55beb613d36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 39.6MB
        • SHA256 5a16a6833797c6cb50db7fdb1b8b16c6c56f85e694a90ece61a8f1422e8afc71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 41.2MB
        • SHA256 59cd7ea6535886540b5a7a951b6794d4b95712b1194311eb05c5f41c40dc2490
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 44.6MB
        • SHA256 f918ce0fb9b7e2bf6ed31f0b79a0fd4134074a0f29a889f5256fb6d6023b9d82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 44.3MB
        • SHA256 31fca224e3e2f4ba69820d51d72e848147360ed93b9db5ba0e0e50a9faa74593
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 43.9MB
        • SHA256 c7a702d02840640cfd1efd4453a0ba9797b546f6e5fcc23cff6458b1acab9b24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 43.8MB
        • SHA256 f61a5828627e93c5128446d443f249f4fbfe0aae50868880dcbe364a416deb17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 39.8MB
        • SHA256 eee6954bde54ce9ac6de087c0e49284125b57c2c4665ab84ff62cb04c3ebe721
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 43.5MB
        • SHA256 078b93b767b0cc521e95e75edb629ea9a3fe6b3c3d47885e0813f0d9fbcf1196
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 39.4MB
        • SHA256 526bb9579d0d237809088839f8407b0df18dfd3b9e8df1a5e813c94357243c92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 43.2MB
        • SHA256 59d7feb02ce79f4912dd221293e7bee0c6be82282d99e5362a93a1a47f49e605
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 43.1MB
        • SHA256 31da8124ff463dacbd830d572cbc6b97271a62ea51fbabbae2a3f80eaca389e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 43.1MB
        • SHA256 b74732773b2cdcc3d5419b8a8e9bb10ba3cbfe766a76acb60f918357d043dcc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 42.4MB
        • SHA256 88324f273d3e0adbff9b9a4fe865625fff7996183d285b51c72238e06cb6a31f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 42.6MB
        • SHA256 f937fa53adba7f69ae9d85cd28cfb271911ad4b0d62e42f4e190e28018e58bdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 42.7MB
        • SHA256 7f7dce15b611f4d18c04bb5fff3b6358f147392dcf3a303566f689e7aca44f09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 42.4MB
        • SHA256 5ef67e79ee9c9221a934277e8e170f9dce79dd35727a3b513008196cbf09b6c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 38.3MB
        • SHA256 27ad8b714264db0b78368100c1bafa0a54a41fbda9f4815a9f2720d21e247791
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 40.6MB
        • SHA256 bdfae6664769b127f5ab0e6478054dc4cff30e55bbf5b13b3553616d70b89d95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 41.0MB
        • SHA256 221b61355b4df585a523d835428ceabe08f6ea2bbcdd7413859b4a142a6a2811
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 40.1MB
        • SHA256 7c5d42d46b0cd519cc8ded5e3bcfb79bb9fd125e306c6ec9005a37e0c90b3498
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 38.8MB
        • SHA256 2651a60877d58c4fd8f8907e501bb14cfab7a9d78d038e509a8405254ad6af3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 38.0MB
        • SHA256 7b85207a12979c1548b554fad16ea17db19b9f64cadafad6fb50c20e8cf99f0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 37.4MB
        • SHA256 2e1a460dbce73f12a5503428dfe984164560256b6a54c5006f42714137a573b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 37.3MB
        • SHA256 36b46ee23e4edfeefc97da4a71d338e9aadf8487357e9f845df7cf3bd54f675f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 37.1MB
        • SHA256 de7080788f98adff3d11bd66e54167d366879ecce2fe38652dc00bcd7aed4b02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 37.1MB
        • SHA256 6c3d935b39f1fcc1f3f6a919ba268aad3eb0da5d6019db87296149f845ba7c0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 36.9MB
        • SHA256 7d5955c1a155e1f701384733cd3b5160640fc2c44f804fbdd811b71516dd25da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 36.9MB
        • SHA256 d997ef84b6a3d73abdeddb5dcb12c209cd528c507da63d90e46c72979f65bc5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 36.8MB
        • SHA256 385c6b7ead976bcb3f966acad9552528d9672626bfd0082fdb3af46f4f9c7d9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 36.7MB
        • SHA256 c9ff4db936f7e6cf7324377b7f2b9e58ff66f1bd0f5fb42d2bf62f097df9e608
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 36.6MB
        • SHA256 28913d933b249913dbcb60358b7819cd2c2d4d2f7cf5d05fd01f837fec9a5d76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 36.2MB
        • SHA256 82faf91b61cbc396cb7b279a23a7b0d7b2504d92e20ea63c596be5f92a67d0d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 36.4MB
        • SHA256 f993146bd3f5b48bbeb81faa24bdada96c7857f73c09da9e2cbe3e36f417f1df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 36.0MB
        • SHA256 1f2b091b557a325b8db442fe3e351aeb340357fcc50bd492be0a5797d9a67e1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 36.1MB
        • SHA256 e929953381976aa4cdb0ac68e5fb23f299c67776079242db34597e77ad1810dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 35.9MB
        • SHA256 a4e19b540104a4e00074d6fb32bf97be25dd82845eac437a86d9cbd07ca5359d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 52.6MB
        • SHA256 918db252e6cd1a63f91c61f1dba994371d6b1637ea7ed30bf9a9729ce12d53f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 52.6MB
        • SHA256 21fe50fafc2639ea67a9c7c9e2014b7546fb8354804ec8fe54a83248ff809fbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 52.6MB
        • SHA256 ba3118c725aa1b2e3c75ea46a22962456fc72071bb92c7282139d224423a4d1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 52.6MB
        • SHA256 1fa6764a41282613081603e539bb10a0347b7a5fc74983333467b2bd8c279c8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4756-24-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5340-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5340-9-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download