Overview

overview

8

Static

static

3

2026-08-20...ar.exe

windows10-2004-x64

8

2026-08-20...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 17:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_81a373bea25dcd5c6d506c1633c6aae3_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
  • Size 10.0MB
  • Sample260820-v6h8aascrb
  • SHA256 46abd81de4602d042d1e7e0aec867e3b79da5027e173d3c0698a0f486cebed35
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_81a373bea25dcd5c6d506c1633c6aae3_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_81a373bea25dcd5c6d506c1633c6aae3_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2720
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_81a373bea25dcd5c6d506c1633c6aae3_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_81a373bea25dcd5c6d506c1633c6aae3_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:240

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 20.2MB
        • SHA256 54c694f2d34c2a17c77c78b605c0154402ec2f06e81dc079bc89e7dcd9f6b3fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 20.0MB
        • SHA256 9dabe9716f933ddc8a8f11bce44b69cc9e44d9a08fca05b09f00d876cd83fbad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 20.3MB
        • SHA256 e024667b8f82429a27a47e677761a1d21aff2b0f6d8bcf48913fb88df88eeb3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 43.4MB
        • SHA256 167c3bfa729b63b892bb4eff9eba2ee8d7a0fd16a33c65f2e91db65b95294663
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 12.1MB
        • SHA256 4b91b42c04c7affaa9d767ba306ebec8943f9fbf82a8ed9f7f8da33c315e41e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 20.0MB
        • SHA256 944677c707cdb03c349a1e4b6f30b2ade1fa25bee763435b9169fee694bdc7ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 26.0MB
        • SHA256 be2e9f3bec4a5b8476b7b5375bae5d335e621e7feb04ac86d641064d209ef848
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 21.6MB
        • SHA256 a8c7aa4f15ba6d7a8cdb008e6286f88c8e049fc1097bdb7fcdcb42b163daaee2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 23.4MB
        • SHA256 ca544c90e4109405279032130d9260123d5e9f497ba32efcad16efd87ba2dd23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 22.2MB
        • SHA256 ff55cf86853c28c5b8c6cb16d03b2636d499026a3a15b594c1e7203dfb6b3f3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 21.5MB
        • SHA256 7e5719c110a5f8cee2c26f99a3053a02b9672f95167d6c86853d936d2edcd592
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 21.8MB
        • SHA256 0e190972587a6a22bb98f546fd42444dbc2e9a5bacdd96844a5456b4154c7236
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 23.0MB
        • SHA256 e20606f2a08065bd97bd8cb2abe525e97bfac2393b3f2e50e68dccddb1026682
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 19.9MB
        • SHA256 ce531a1450f8f068d1eb15e955b55c199cfbc4a70faab831acc225fc35848305
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 19.9MB
        • SHA256 e54fb5ab0ccfe09c9b89b52ab63ab8d38e31efcacdfb257e696286cc3cc42bf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 19.9MB
        • SHA256 6d6f64e03b3acb99964bbc9204161adacda0af3f88a8882c66a75ed158791db6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 20.0MB
        • SHA256 707d5b6c9a2a6aba2d90c56c5a371f7639e11a7e6591e81a5b784dcbc085dac0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 19.9MB
        • SHA256 5e51377803e9d4aef7adb68d37687d83ef1100cbf5e7afeb55477d2041c3ccb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 19.9MB
        • SHA256 50ad8a748f23d18a8a451eaf0f9ecf6622bd7237cab6b38f5689cce34ec2556e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 19.9MB
        • SHA256 4a1780831b9d6f18d2bec6433125f0af30a973a42570290d94504efc7a4d7023
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 20.2MB
        • SHA256 02ed857df5f9e6cec625f901ebf6fbfced2f950b9bd3579190dbce52dcdc0f48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 19.9MB
        • SHA256 253f81aed6ea9c0b2994fb3f6335f4571e7e8d3996a64f35380a3bc0dc936b85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 19.9MB
        • SHA256 dab44a89f68d7225e15c3a9a5c07654a1da8eef1f7a138be5356b5ec303fadfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 20.1MB
        • SHA256 7c9ed9bed502bbc83b1c3e0350054874dceb409c44da87f045faf15ca1f9c16e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 19.9MB
        • SHA256 0403b4db87267f370fa18cd867160847a8b41c876a0b7eff6373c1916b4b5363
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 19.9MB
        • SHA256 0b2e1c904bd45b21c4d3759875eb216c6e04b15b121accfd374b33a1fa35046c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 20.1MB
        • SHA256 397720ac551b7d40ccb41714f7198728832e66142d4884202a9ea08e760bc5f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 20.2MB
        • SHA256 9cbd886cb7bdfe41de43101ecefd9a831b483e4e46799992c9e2cd0e7780309f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 20.4MB
        • SHA256 6d9b1d3e8e98d58ffd7d752ea39c2c6b5ace9396572471d3f930951e8f95d60a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 19.9MB
        • SHA256 2ee6b9528e9de43b608ebe7ef5b687e3383ae2ce8c13190bd03c074a4db3c42a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 19.9MB
        • SHA256 64283b756ffdbde4288ad5c4070555386b97be6be1efa86a5d7a64521db250c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 19.9MB
        • SHA256 10366b244480bf6373849e555439ec72b8de3d606c192fe25eb0d23754d0fb0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 19.9MB
        • SHA256 6ef82e6dfb96b1316d1a8bf2f7f5d50f559a108fcfd3a5c6c4489af21f4800a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 19.9MB
        • SHA256 18603180eb876520b0f3bb45373cf95e5121eec262186b29444704e63327a05f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 19.9MB
        • SHA256 47be62002655ef4fed62966ffe25bd552d52c18590735098585c668b6cf85d01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 19.9MB
        • SHA256 dc7c3e38c60ae375ed4d9d4c01ed93adc243d0991d950de854b2f968de8cc7cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 19.9MB
        • SHA256 1f5b38fec87440a72bca28f57b9a12c36d38340de06bc1d7bae24f4579e90223
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 19.9MB
        • SHA256 26fe01ae16ed451a8b7e8ff2f01b5970b776bbbe8cd877f41a31b38877c925cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 19.9MB
        • SHA256 10f0d07915df2b1e8fa31cdc2d2bde6362322dc5288f7f3e706dce7445c72e04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 19.9MB
        • SHA256 32a6456ac26a0f27cdb3256099eea67dd9a83c1c84daa0c638a2dab2e223dda0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 19.9MB
        • SHA256 92e4d2131683510d9a297d43558598676beb62d9b156806370149bd6e8c3947f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 19.9MB
        • SHA256 f30e03e8597a47a4bf547ca244f3015940d2ebb00b95feb2db13863fbeefe250
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 19.9MB
        • SHA256 529a678cce38d9ddef375cc9c028d11ee2a8aabad28d4ae15d1a62d52ad249bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 19.9MB
        • SHA256 361a7ca9e9eb7654c89c02ec7a14c8a6ef9317c4f240f33fcb3335eec0aba509
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 19.9MB
        • SHA256 063da338a3e6293bc3d8b56e484823e67d290e56e778739f55a72fc71d81d726
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 19.9MB
        • SHA256 7dae16173176c507ffc4d3f82cee0fc1c618a18e0e8013db7edbb92fcbe176b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 19.9MB
        • SHA256 8c28e72b73d0378c66807c2768960b1a1aefdb8baa71749da5daa3ee6eea55e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.9MB
        • SHA256 5a53479c07dccad3d370da6bfc89089ac44232c98b77e3f73939611315815c25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 19.9MB
        • SHA256 e798307e9fed9abc7c775b980bc21a78671b6e1198c96601d82fc208ccb4cb8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 19.9MB
        • SHA256 d67d08d2f7ff0d3a3ecc4f1c388ccef47d61899e2e64ba4630e2215744bcf748
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 19.9MB
        • SHA256 737c01e639029a162322f6f6761822dd5a9b5f781ed14bf3a05b5a8d03b767d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 19.9MB
        • SHA256 720548c4b841a0dde5ca234698fab32d3e5fe17bfc1f7f1c110b514abeb67930
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 19.9MB
        • SHA256 10a99fff864e0f101a9814b8f70f525105fd7c92bfc24a666575106d65a941fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 19.9MB
        • SHA256 41cdebd52b24895880c6d4f20c68029ba31e4d4509a9303facdafdeaf83bbb3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 19.9MB
        • SHA256 4f8c8d7fb9f23cb8d38d509f23aac861fc16e2d4308d66f0a131255db1c44320
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 19.9MB
        • SHA256 415dfd4c30968417e8f591785424890853d10c623b3ac1fe083325456801d947
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 19.9MB
        • SHA256 b48a6ad29ed3c76460c6b61998db2fa7922e47635399f891e9b1d51e219a3edf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 19.9MB
        • SHA256 6f77684312cb9aa9f4e90e55a8928bb76b14eda5417fbb378dc18313e7304669
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 20.0MB
        • SHA256 5448d82949c278413ae6a888db1f9865cfa04e0bc102df9252c717f9bafaa473
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 20.0MB
        • SHA256 63475a04926a37e479db1802975b614478d407fe32a1a55187d8dc57615914b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 20.0MB
        • SHA256 6ed05e0c1522e493bacabecd07228d60c4195477176f51447be3183ca8b17298
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 20.0MB
        • SHA256 9b2328430ccc581d4683942a3a70d6963b4372817e5d15eacb0e48187df191b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download