Overview

overview

8

Static

static

3

2026-08-21...ar.exe

windows10-2004-x64

8

2026-08-21...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    25s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 04:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_5ed09b391d71af707c7690349a322d96_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 29.4MB
  • Sample260821-e5j57aw1bx
  • SHA256 839bc1afee4d9f1b90357e0b5a6c7604f5de1956b08d202cba7ef01305d4a4a0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_5ed09b391d71af707c7690349a322d96_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_5ed09b391d71af707c7690349a322d96_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5984
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_5ed09b391d71af707c7690349a322d96_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_5ed09b391d71af707c7690349a322d96_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1132

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ApproveRestart.exe
        • Path C:\Program Files\ApproveRestart.exe
        • Size 29.9MB
        • SHA256 8e47d6e2b4ec0a3162c40e2407b8790bf531e013f37c99bbce0ba6698d87682a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 59.0MB
        • SHA256 59075952cea2da4c7c07bd73405655bfdaee02cf859b3e2f6dd1a01f369df33d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 58.8MB
        • SHA256 c4300fdab7a7cb7f9692fc48509c361f7cdb24cfd035194f3dcadd52d2f1533a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 56.8MB
        • SHA256 ce0d679dd952bde7239ebe6d8c62234fc20e9e9908903c03d5c6c3726b5588bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 57.1MB
        • SHA256 71fc4d6cb4571a3e71b90f7f0b0ead0be52083c827308138124b42428a332bf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 31.5MB
        • SHA256 c552832bf198cc835354280ecf472c287a8999a034ff12c8102ec423798ca58d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 56.3MB
        • SHA256 3d9b461c6b7e171d94496b5337a52ee4a98807c3f4cedfe9a0bf5cfc40afa69d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 50.6MB
        • SHA256 9267450966f8c9a0f7e72f3609ef144d87c76bf02fbac9fe51af946b29339d38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 48.3MB
        • SHA256 0f5057749ba5b208465264b4334fad1b4deb113e91580058d823b28216ede05c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 51.4MB
        • SHA256 212b18b59c155daa639e19187f10d52bea6d65cfc6d26ebcd72dc7d38a130835
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 49.3MB
        • SHA256 d98ab1f4cc67cef6eac8f228637672fa8f8006e954c94216c84916d0e0a59e9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 46.0MB
        • SHA256 eb4e9f62f4e1fd535f39434b1dea2098131d1bfc80a17054f33524661e172e9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InitializeRestart.exe
        • Path C:\Program Files\InitializeRestart.exe
        • Size 45.1MB
        • SHA256 3c8aaee158856954b18a409a8a61a9d5501dcd405228197cb9c6f48cb9fc1eea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 43.8MB
        • SHA256 5c629b31d5b0d29bc3c09a565728327145e9206fefebc68947ad8276b760db1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 42.7MB
        • SHA256 836a6920f1c3abd88a2e9c7ebae72ce2cd070bb0d8fb8d2e740a141f63a96838
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 42.2MB
        • SHA256 36b61573214c76b987f11b1275eaa3180df5a73f81232e4389ae4de670d43ecb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 40.4MB
        • SHA256 e6beedad04768add23d016dafa354491bd5c1af6a707b307ccd2a03954282c0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 36.3MB
        • SHA256 27d86e641f5763cea7385a797de8d4b5e6afce7e264622f669c43acc7d92ec4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 38.1MB
        • SHA256 411880c965fe9b61ec26169b0b831880f116e1850973d3444ccf203fc05f53fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 34.6MB
        • SHA256 84200e69902cc578cf8f0568dc5c71e4cb86747f7ff7280a26958a8c22c38c25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 34.1MB
        • SHA256 917c251ff9b7a6d9e9868f1475e35bea19b333b2965ccc2b57118018717877c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 32.0MB
        • SHA256 81cbcf1783433c5facdee1baccdde66dc9ec2ae4a48eb0c4c2f32b3e731af4ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.6MB
        • SHA256 9557f273c84b879870ccb23427f4dd36a472b0b1f3dd8e1273095acea417f04e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.7MB
        • SHA256 7d9933b88c19c89a1912ec440681860b59ce1c6d609d22e17619520c43ed12ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 28.4MB
        • SHA256 8a08d0239f336e654d3638732cd74468c2af7ec2b363209ae6eeb210dbfa2627
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 27.9MB
        • SHA256 1c398534d5dbea066d4e28ed5b9984624b49729f1d9c10ceb7effc11b80a6801
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 28.3MB
        • SHA256 c2fb2c1c0ca20348d8d7471053aab701a72797496b9ae8f597f87d140da48fcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 28.2MB
        • SHA256 21d02927b5d97934d6a814758a3e3d4d0a9059e63f35308b90426a959b8d68d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 28.0MB
        • SHA256 8fcde1f3f982e9e141a19f602bb6f8e631f31bb9e757c2c88bb3c505ba575201
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 27.6MB
        • SHA256 d9b60420b51453c005c9bb28ce0ff9771efa76b72ed95b20b0ead5b15301c6db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 28.0MB
        • SHA256 2ba2e4edafdc1e93e61857b319f28dd8496f6ce4f42ea8f344f30948390f65dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 27.4MB
        • SHA256 8f2100fcad1dce995d84268aeb09ad50e35769b376efd2079b070926d5b5ae3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 27.3MB
        • SHA256 6c167f7414b294eeb471d926aebf0c3d5160981d8c72d8867d5bc02369781fb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 27.3MB
        • SHA256 bd20f4106868093294ef5172754055ceeee7c93955ac6665ff5e228790d232c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 27.3MB
        • SHA256 1a9c3a2494df51aafe0bc22fa908cd80236ae4f402318cf1697c45dc87b5b563
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 24.2MB
        • SHA256 a001d577853229495b55b254ffe20f8ff768a1ea96d156f33a1885d853633233
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 26.5MB
        • SHA256 4224db16cf7cc4f23e9fe8c91297a69bc6094d0c250e947f76177ad2f2c3f4ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 26.2MB
        • SHA256 46bb1bf0a22ea1447cda17dd820899cceb7d86cba90fc27b18ff63086f3c7a9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 26.0MB
        • SHA256 2964b47dc536500908ffe7faa9ef9bdde9aa756cea921ce3f1c5b87d56679f35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 26.1MB
        • SHA256 5ac90dad148656a18b5c717b3592a32f4d791b76d721a7e2a0b9664711a00a0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 25.8MB
        • SHA256 25f20acb19c99834c1f2527dfd8311429cf0d5e65892f9b701072e0868bdca7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 25.8MB
        • SHA256 146ff8887666c82f5539087c91c67dcf19a74b16d04b3f6075deed3e709d1ba3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 25.6MB
        • SHA256 b3a85ef6141a3ce238e2eb44faaf02e8664bece65269c573c4f22465a086cf16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 25.3MB
        • SHA256 167674b4d917b45ab99618189477130b2a4feb78ca8606a36c7ca00f0abb2bf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 54.8MB
        • SHA256 372ddfd1a68fc7cf9cfc417e06404009e2aabe761f27618e4e4de9f5765da019
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 51.6MB
        • SHA256 72db182cbd5edd6c14d0df3076353a1db3239f6661eb59d9ba5190d3d9346d9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 53.4MB
        • SHA256 6d86fd04cdbe63bfc72bbdfe763d89084bdd47e243ca7a2388abd919e0df87d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 51.4MB
        • SHA256 b750f83312892a42d48dfe8383173954e05fc5c5ca58c52478336d4f68e2dc45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1132-8-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5984-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5984-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download