Overview

overview

8

Static

static

3

2026-08-21...ar.exe

windows10-2004-x64

8

2026-08-21...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    132s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    21/08/2026, 03:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_c2f6daa1aae20eaf5c05e7923f1137c5_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 46.6MB
  • Sample260821-ejch8awwdx
  • SHA256 bc08a5dd8c81c99c2a6e18d73704733f130b916fba0e9f1de5fceac14b7f06d1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_c2f6daa1aae20eaf5c05e7923f1137c5_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_c2f6daa1aae20eaf5c05e7923f1137c5_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5008
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_c2f6daa1aae20eaf5c05e7923f1137c5_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_c2f6daa1aae20eaf5c05e7923f1137c5_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:556

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 47.2MB
        • SHA256 51a5230c4a4e13f8d07005fb8360588c565530a482c802001e80c0bcbcfb4928
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 46.6MB
        • SHA256 cd97f4092e5fae4aeed68899b4bfd28e77a352a55ebecc33f8f94ed7d13205cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 46.6MB
        • SHA256 bc08a5dd8c81c99c2a6e18d73704733f130b916fba0e9f1de5fceac14b7f06d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 93.5MB
        • SHA256 df4ac5558b373967ca5cf3192922a541592464311c5d41ec43b9af7b98592f0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 46.6MB
        • SHA256 ac583d8c2120fd407e15129842a3c11387c30c9b4906a056deedc11b7c8813cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 93.2MB
        • SHA256 361b8471ac5802ce2a276fc1ae98ffbcde36373de803bcc3bd64056cb92076ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 93.2MB
        • SHA256 a1106a729cd3096160485e90a7ea979970be4441c185353ddef8019a090e4197
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 93.2MB
        • SHA256 76dd295702c0ce2cab357e0f3c85ba2557045e2a50901bbee549eb203d288838
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 93.2MB
        • SHA256 01a7c7cc575e916392aad708df2553c3299f2b6367a72093d3be13bf494e16bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 93.2MB
        • SHA256 5301f51f8bf8af22fd8ff28e7de2c0af7adf74599800925f0df2e9d9784c6d12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 93.2MB
        • SHA256 83586dd910591aced40780982134e4a9304c63a1ffbb680c5a9022d4a9c5c317
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 93.2MB
        • SHA256 4ca3252c16ee31144488361789d60eaad361b266116bc62e1d077a93434644e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 93.2MB
        • SHA256 7a2c35d98d0ef4793117b5d8533764327c8b1acbbbd8a287099f03ecc7ef47ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 56.6MB
        • SHA256 3b7c48bcc46463efb2f86b87a21db97e51adb8f9672b81dc94769825996f21a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 52.2MB
        • SHA256 5b0ea7dc8e8337e24799c5dd432e44b24c96e2a3ed62b77bbca75555a3099829
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 54.6MB
        • SHA256 9b31d5114e8f31d4e2b26853cc97c2f33344e81bc20d4f455facc62b12ca424e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 32.9MB
        • SHA256 148f96cbdfef67f41d8dcb08280454b2b030e092a2e354c10b5c3b70a03bb144
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 30.8MB
        • SHA256 137338ecbd8c6e5521696799800283802f7034c9115f604392f6e4337184cd8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 28.9MB
        • SHA256 2ae8421f4e143752e0fdfe304ef7eecf0cb5d6451b79ae3ec8d3d81fa0acda39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 28.1MB
        • SHA256 d8067a2a8b55ba3e4cd39e6615af78fa94a80e26a4f24d1b0f3742079dff7fa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 26.2MB
        • SHA256 669544d9bb8a41871598870944718e411459d2f45d43ae2836deb9737a366aba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 24.8MB
        • SHA256 c22030a50f465d38e78b7d271694fd59c7eba4e08972a32297a1cce8a74db47d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 24.3MB
        • SHA256 b30250bd651bed108c758f3c5cefb8bc13211c0b897c9b6201fdb36b2a5b30fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 24.0MB
        • SHA256 8fbb8f737f228b6d7b2685fdd3b3dfe66b791b5fbf705fbba5e698c7a46150ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 23.8MB
        • SHA256 938dfaef44762834aadc874b4a9082ecc82a08b2602c26a04e2f5ae2f05d8a08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 24.7MB
        • SHA256 95a1dd4fce2fe96b5b8883e7515f0f979cba4e8feccdd1781da7781507a4d002
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 19.9MB
        • SHA256 6ba1dc44068e2a1ac76e36dae294e677f0b413a97beaed53eb054279a38f83e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 18.9MB
        • SHA256 46f98357a27ad31bf163105e47380fc9000fe02fc24f8c616008931979eba7af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 46.6MB
        • SHA256 5e9401d7148d0771cad059f6b1465531f6f3ffa7c3d8c476018f85a742a3e1d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 46.6MB
        • SHA256 ca82c16f141eea8598f95f77e257f4a5470e959b21728b216005a05a88824877
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download