Overview

overview

8

Static

static

3

2026-08-21...ar.exe

windows10-2004-x64

8

2026-08-21...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    21/08/2026, 04:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_5ed09b391d71af707c7690349a322d96_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 29.4MB
  • Sample260821-e5j57aw1bx
  • SHA256 839bc1afee4d9f1b90357e0b5a6c7604f5de1956b08d202cba7ef01305d4a4a0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_5ed09b391d71af707c7690349a322d96_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_5ed09b391d71af707c7690349a322d96_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3800
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_5ed09b391d71af707c7690349a322d96_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_5ed09b391d71af707c7690349a322d96_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4844

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 30.1MB
        • SHA256 a97b7b9de5a75f87e7ffad3c3eb6df9b0c893d96da798c042d4cbf81684cd105
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 58.8MB
        • SHA256 c4300fdab7a7cb7f9692fc48509c361f7cdb24cfd035194f3dcadd52d2f1533a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 62.8MB
        • SHA256 2931426dc42057b7036dd463d5bd339f89ccc95b197798f6cdf9fda3f209c8c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 59.1MB
        • SHA256 7fe99bcd8dbf14591e8a6416adea717388800a63c39c20bf0af7811715b4f64f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 58.8MB
        • SHA256 74c59d85ca42895d6e3509fdb8734865aabd3c6d8eafc649db1cc5fc28c86e0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 64.8MB
        • SHA256 5f4865444966ff40d8a4c3eb29412ce7eeadef112ee54fff1c9b688a549750fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 60.5MB
        • SHA256 9c45b18c3a091ef923c58438fd13ea42064ecedb1eab2b5e84bfeefa3fabe027
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 62.2MB
        • SHA256 4a8d4f1a8226aedac6a955a9a93ded2d72ccbe72e7bcdbf4b7ba414c40a556c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 61.0MB
        • SHA256 913745b1dd8d1574495c0c51a48e68ebf67d76e495a1da5638bb4f4cbe7cb394
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 60.4MB
        • SHA256 41db9d927d293e91bc72c5bf3e1f5c148088ef20357488ec6ea4696ce2550b78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 61.8MB
        • SHA256 b0de2015e4d4f25b3d3a7661e4ae26e470c8de291063ccc5f9e948192deb8499
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 60.2MB
        • SHA256 502f387083f1f4188aa0b2cf7ebb01b23087a6aaddb3b0a5413bddbb0fcdf5d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 58.8MB
        • SHA256 3edd6fa1a2c5ae1dc2f098a4aa3e4ddd9f784a992df061ef8eb4ce39f56cc9ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 58.8MB
        • SHA256 c3e1b07d2fcbf934cfaba71b0474903cc62992073cffe66d63f05aeceadfabee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 58.8MB
        • SHA256 f49dec6acad0bebf756a208234d248272d75617aed50e44e57f8a7420a20bf2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 58.8MB
        • SHA256 584d423d2500160fd8bad87335525ba483a8e8c716c35c7ec615e21244bcdc5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 58.8MB
        • SHA256 80ea69cc1dcf52e864ff404a765e65318e7abb90a498634886700de86fa58083
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 58.8MB
        • SHA256 0c43e4c29756e4e6380e6e070e910c58b00f8a7747983518e73492a50e102118
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 58.9MB
        • SHA256 8c26500e98f1b03a38741c30fcbef52090773d474502cbbe70846da5abf89740
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 58.8MB
        • SHA256 8aee89f16a561d1d92534bd3c00a6704706668ffc55426dce665ab0eaa7e5a9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 58.8MB
        • SHA256 1b6e9bc418d141cbeebb58df6cb03e2f38806b724617afcd7cdbb26404a99200
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 58.9MB
        • SHA256 0980d90a728e18016b936f87f754663e9515e0897b4c4243fde1b00a9827a024
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 51.5MB
        • SHA256 772b3ee21b70525ce13ef2e856d021e6481483338d63ceef8e1822066ad6c893
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 50.1MB
        • SHA256 c7fa0e2f72b71fc9e1e4fe0a2c1706042a0257d74632705985b84386e45723ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 42.1MB
        • SHA256 5b312b6fecd0dd83058db8223c0615b3d15a0648973b0cf94ed4bf3fc4294c2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 38.8MB
        • SHA256 e6737ac03ec4f3b8dc6cd1b567c5a13b843b656b04b85d6b7ab0327c9af23412
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 36.3MB
        • SHA256 dcbd95b046b4f93ef580a50c56b3b1e3eac3f4a2ec30945fdd2660b24f34bfa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 17.4MB
        • SHA256 d1db701d624a902b93b10c619695dd1c0bee4dfc5f9b529c3bb2bb028d632234
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 8.4MB
        • SHA256 7178affb593e6a9e2f0d67ab15ec7a11c6a695f4470261009486e8b83fe53655
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 7.6MB
        • SHA256 9effcb31ef6f4f5e100ae5032b69beaa6d69ae567420ed0ad1cb5bbedec74d6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 6.1MB
        • SHA256 cdf83c91c661c417ec17afc0ec89e23599386d6635e9533e952ca7094a7d1f9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 5.2MB
        • SHA256 4bdf9e0f18927bec50ee855ea2effe0d4ee9c9e742a56b03b64b1ef35d5bad75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 4.7MB
        • SHA256 3c4bdee1044824a866253278feae027e3bb1c983185718784dd46cb0ff53a556
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 4.9MB
        • SHA256 011ffa1d42c2bacd7a00714158e636eb688576f0b4bc83c9f765e4901e4bede4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 3.7MB
        • SHA256 ddbf847a37232c4c60c0b9637820eb3ad7e14e2eee77e45c73256132f219c97b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 3.1MB
        • SHA256 b74e25817355317d677cc741f968ae304fa83bec4221f02458c447fc26151fa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 4.1MB
        • SHA256 b6bbc6273b945fde33686e5ca4bfed7f551f162ed2c54686f24c49a482e96b4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 4.0MB
        • SHA256 aab7e8f2c2a2ab6efaea06d4868ae9bbc147b4d880fc02aa929612dc270e20d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 3.3MB
        • SHA256 521ee8836631779fa054eaa2e45533bc0ba23ce65db27124026e4ddc6ca008a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 2.6MB
        • SHA256 caa5006dec794a4cd9f79fdd1aff66ab7ea413c17305f10f7091f214e9dde037
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 2.4MB
        • SHA256 42f14574254ab05c762c41d0671fa5d99c85ef203bb3525c74754b6cf1d1b362
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 2.1MB
        • SHA256 1d2a9be7646b843dcf3597654f83a90dd8d46048cb1440a6e7c2bdfdae06323b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 1.6MB
        • SHA256 3c93a2d4a4fce0c73f0b079dde33bb82884a439e3279018e41bd462c1e44dce5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 1.4MB
        • SHA256 741ed1f60ab44ef32419fdaa0894394149bd6396f9f1b69fac0fed34a7013dfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 1.2MB
        • SHA256 5e67f52d4832c546d1443358ce19c43bffd4bf075d7a89b04452f58002520f65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 618KB
        • SHA256 54e5e60d778de3f25cf0fd96e42fb6fba1096bfbdc8b462226442b3f0ec23b98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 477KB
        • SHA256 09e711230dd394af28eeba8d91c164c217f7e955cfcab87084077b83adc64e4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 187KB
        • SHA256 7ac14e39982bd90465f4135ecdab2e968e4ee3c42316a31d0bd7196a76cc79a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 192KB
        • SHA256 cc71df767f30aa32b4d730d3c0244896e3d45eb216f18568c46371d93640cac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 58.9MB
        • SHA256 f221f52fe8f01d7d72d50b98259a431f8b6771d8ddb9d30e25f84ca25c2e25a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 58.8MB
        • SHA256 8d707dee2eed8777e52dbf15d8e9aa88834cb14fac7764bc533031e17515c625
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 58.8MB
        • SHA256 1baef3268f6bf4de4343c9eeabfe5d809010ed4d876a17372b6c5d80b015967a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 58.8MB
        • SHA256 bf8c17f009b8b75e193fb62eaad98e9f58d1553979bceaf0d88760a47004dea9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 29.4MB
        • SHA256 839bc1afee4d9f1b90357e0b5a6c7604f5de1956b08d202cba7ef01305d4a4a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3800-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3800-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4844-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download