Overview

overview

8

Static

static

3

2026-08-20...ar.exe

windows10-2004-x64

8

2026-08-20...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 17:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_6dc2fb1975b6c95e365aa3ccf90af2e9_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
  • Size 10.4MB
  • Sample260820-watvkssdpc
  • SHA256 3d6c39a993a478d2b0e33af4f614f98e2e74e82a40243f281dd02d912f80e894
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_6dc2fb1975b6c95e365aa3ccf90af2e9_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_6dc2fb1975b6c95e365aa3ccf90af2e9_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4680
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_6dc2fb1975b6c95e365aa3ccf90af2e9_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_6dc2fb1975b6c95e365aa3ccf90af2e9_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3248

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 11.0MB
        • SHA256 5c6f294bbb6558dc0ba117ff4fc0242c4231dca2577aa99b91744602dde87821
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 20.7MB
        • SHA256 7bcaca77e8dba825c26a11fd98d548131886f1045993deba2a34f1965557dc57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 10.6MB
        • SHA256 3230dc1118c0115202f713d051deda148d1b92c2470ea1bb23a352d2616e58a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 10.4MB
        • SHA256 9a264e92c6136490b0eb5d1945641ec0fc1c0a05b83f498f31f23a8f46f6223c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 24.8MB
        • SHA256 00fe51d43727f65911e505f9620c223ab6a0ec953678073708adc57aa5c5b6ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 21.1MB
        • SHA256 b1d6e127d2268e70f72be42be85916293cffeda282ef4943ec27c011a36c95d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 44.2MB
        • SHA256 4324f931f6cd814ca536b42fec8647feb87601543484d9cd5c30a27cd398fb79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 20.8MB
        • SHA256 a7ca119308ba017298ba9f4e0a00ee06260e5217612d5c18881dccc9bbedc2fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 26.8MB
        • SHA256 a04d1d83855077dd4fb9cb15abe5167f9269c6c2ba4afe26f710b0de489b0030
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 12.1MB
        • SHA256 6b796945cddcab9e7bafceadec2ef84a550d6684b540376ddabd950c992386ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 24.2MB
        • SHA256 188cd012e9951986ca2bec621c21d7d97934ef5ec3531bb7e2491c0f55c32d52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 23.0MB
        • SHA256 61cc3cca84761923c6c4de96a1ca047fcbe4a6aa9703e62cd289c33828526154
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 22.3MB
        • SHA256 8101171be96bc2dcfdeb9c01970ba758966b3be95b3ae2938d14c2098c844749
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 22.6MB
        • SHA256 f9ab8642f8091ce3f193c35c47aafa5463170e2355b42c4e7400b67d7f944420
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 23.8MB
        • SHA256 88590bb689a90741d97b6590cdb2378903412d8dde06f3a797bb09f92c7cea0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 22.1MB
        • SHA256 836dd1205816f6e72de6d7944c0eb551046f2086d00742314fd42b3601681058
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 20.7MB
        • SHA256 ea7b6c84855dbae8a9438ac2fb6920e59202574446bc77358667e26bbdc9dac5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 20.8MB
        • SHA256 ea8ed26312f4fc4fc975c19edb7d2cbcad0239386ef490bab307932f09efad04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 20.7MB
        • SHA256 5f4215e725d86d066244fec56630c69fdfa33141f3c5af477fd3149c5edf7a05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 20.7MB
        • SHA256 5c9145a7cbfa0266b5c6122d84d2f7231b7ca0a0273c21d9da00b6e7543a72f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 21.0MB
        • SHA256 df7470ae1dddbf332ef4826a52c7e4d46556e8131a0a78569633d1c3699ab767
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 20.7MB
        • SHA256 28d4058abf6f28a0115393b852c7142e10be7aca0abe59be35b1da8360952c1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 20.9MB
        • SHA256 b5572684bceb2608017f2c1a62aba71408555e888509294add40f9151ab011bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 20.7MB
        • SHA256 382f25e3ef5df8f4ffcecc07195f42e61ac4468d8e54bb3ec4466e3c4f726a66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 20.7MB
        • SHA256 e8c97e78ca363260846bff836c46859259c1b30977ad1316f5b39732e2f21c98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 20.9MB
        • SHA256 a5d8e00f3af0a1bc1683ae11b9b5f51434d7429ea06efb1fa95bd53e24cd8e46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 21.0MB
        • SHA256 d7005e5795f5315962b248d8f7aab6a314e1dfebe58ab668d6e790d0e98e4a2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 21.2MB
        • SHA256 8031ce8ecfd4a2cba646aa71bfebc2cfae8ca3aac949ec8b81437415d53775be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 20.7MB
        • SHA256 53f21c7da252d35fdec09848fc8af3815a59829fe0bba4214a5087a4a957603c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 20.7MB
        • SHA256 84f26ea3c8f040ba18e76f9bccdafe7735346f69eb6bbf651d17d4c0a49f9ab2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 20.7MB
        • SHA256 69e8900a33759ebfd2f6a41eecf770e2a78467da83b2c68041796b0624694531
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 20.7MB
        • SHA256 27c6c7dc4cfdb62b228bb5bf725020410f1522e490151862cc4411782c06f0ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 20.7MB
        • SHA256 e868115d7926741498a499174803f984c2a33413eca27d837ea005443a11c3da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 20.7MB
        • SHA256 125111a609491362e1198f8ec6d65db938c8ff9477eee791d82069493756d96c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 20.7MB
        • SHA256 12aecfaaa42c2b08a8bd26e14cdaf4e8f86c9e99b9c50562540d2503e87c2348
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 20.7MB
        • SHA256 55230a7cf04affca85fae82b2642ef4ae62ef44ad90dab210d82f1ae77d5f058
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 20.7MB
        • SHA256 488c619f8d14e2d50623a84f7ad7809829172c894e29f56941b4746ef92331d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 20.7MB
        • SHA256 ec3bad00894f9b7d356b6195da4e5e81c150ce10427730ab50b7e3739b17198a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 20.7MB
        • SHA256 4a60b8466b8133ec78c8880cee39fe1462b9082c48aa42e5edbbf2e91a4cc469
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 20.7MB
        • SHA256 7d89ad14ecf792c9ca80d3e73fa02ee8bdcf9c7bab8aa20a4f75da528a92afc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 20.7MB
        • SHA256 7d4f7d5f293e55d2bfe0d9b5db6c0ebcfc1441be9104c7d1d7284d592913374f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 20.7MB
        • SHA256 525fc1268d44ba87c72e350fd2c6762e2ebbc492d102fa8925fc4936c3573629
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 20.7MB
        • SHA256 5e810de16a5af7da2c2eb499aa6fea40840feb5766f3eb533f474cf142a9932d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 20.7MB
        • SHA256 09e195dd16a48d0efa495e96bfbf6a24755a71b8d8b23394d8f00fa8120c00de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 20.7MB
        • SHA256 7d12dc5df24d9afae2b76702898ed9c29b12391bb8f01324c61e0e9aa2e28857
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 20.7MB
        • SHA256 ef1434b05b892a0e69f3dde070f995a070c205dd86f04c1120f186b307d1e737
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 20.7MB
        • SHA256 610f135734396e0323d8f73f61a8e5210e9fc5d91f7bb136e099d5ab2dc3fdd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 20.7MB
        • SHA256 82c37fe3a7e466bf96ce21542c8705d0282cdbd9e0cca8d029932d0a8de16632
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 20.7MB
        • SHA256 3518b3836e535a6753e00336ac2a1a7cfd99354042d56b0c65de63973d18d9b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 20.7MB
        • SHA256 f38f87f32af84b7e9bffb0f891490c9f1866c42af909bcf4582f7a10da73652f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 20.7MB
        • SHA256 083dc075aeb5ab20b400e7796ae770af5daf901fdb9003cb9c4433afeeb28d1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 20.7MB
        • SHA256 b397a5a9b7fc9ed747b9b83dab72d88dca3af0a1f7a338a6f657c218ef8a5329
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 20.7MB
        • SHA256 3a034f50b892c9b999638964e2b7aa3a0f0a997938126c4e3823c6b1b5f629e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 20.7MB
        • SHA256 c1c10923727f5edf509cc25d5f8e166d40d9e8bf5bdfdc2af7348c57e66a991d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 20.8MB
        • SHA256 85f7350848f4b606547abde8149316b162e0a1040af03bd3c2864454bfe0e205
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 20.8MB
        • SHA256 aae43ad846bd83b452a1457ab1ffbadd8df9587de0f439695bf1953a0fb46887
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 20.8MB
        • SHA256 181e2fcccbcbdb23c38c638cac5497eaf87bb4acf1bc13bf5d824f2487a85861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 20.8MB
        • SHA256 723bc6c7a5ca1e89770f38069c1fc499764df7ae4fde298bcfd566ea9012d35c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download