Overview

overview

8

Static

static

3

2026-08-21...ar.exe

windows10-2004-x64

8

2026-08-21...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    145s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 03:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_c2f6daa1aae20eaf5c05e7923f1137c5_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 46.6MB
  • Sample260821-ejch8awwdx
  • SHA256 bc08a5dd8c81c99c2a6e18d73704733f130b916fba0e9f1de5fceac14b7f06d1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_c2f6daa1aae20eaf5c05e7923f1137c5_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_c2f6daa1aae20eaf5c05e7923f1137c5_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5520
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_c2f6daa1aae20eaf5c05e7923f1137c5_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_c2f6daa1aae20eaf5c05e7923f1137c5_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:780

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 46.8MB
        • SHA256 8069f866525285bfe3787c45c452e72c8917da0307e3b720c6f4d5865ffaf82b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 93.2MB
        • SHA256 67a320e68bc9f2b564a3c7c35de2ed36a8b94ffb2b2392f6cc17a6b1f3539221
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 93.5MB
        • SHA256 df4ac5558b373967ca5cf3192922a541592464311c5d41ec43b9af7b98592f0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 48.7MB
        • SHA256 220add285a7c14d820b89195738836c506ef5c884ab9b5ef088c7f152a04b969
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 93.2MB
        • SHA256 dcd13e0f3731a4c175644605ef99491cb5f969b21d2349527af551165bc9acb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 94.9MB
        • SHA256 14e2de08f7ab9b8a7406161f68d7cc0d83be6d241a9763f8859f14e854958f9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 95.4MB
        • SHA256 a58985b20b8726593d8bcec31126809eaf6d8944e6947c6362a1af51cb32d756
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 94.8MB
        • SHA256 1c61738dd234ef3105a11ea9b08e790ad8e6d7a0fa9da8e7899e012cdbb2bfc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 95.0MB
        • SHA256 b1523cb84f02aa057a3ff8e124063a8335d6d4fe17f83eecf1f149cfb221ac1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 96.2MB
        • SHA256 8718565cf8bf9da9456275f8d635484764fa55d1a84c80e3eb98af37eac751e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 94.6MB
        • SHA256 ca45a0e34259555e2b8c44176a654486d6111624745d31a7a2e757b918a2c263
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 93.2MB
        • SHA256 a84c653e112ddc51ba23ed2d31f24ffecb2f57e374cf9b04cd486d57e0992ac0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 93.2MB
        • SHA256 95e7c9ef153c39b05ea2e253bff733edda48442ac90144fd3a349d2752c22575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 89.6MB
        • SHA256 e4e682abc919170650261cf0cb8d63263d9ab3ff5ad123f10baa99e0c368f9db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 88.1MB
        • SHA256 f0cda88b13bc9fd9f59eb65202879a9d79a50e1066053ddbc37a00b50e3206ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 87.9MB
        • SHA256 21aa72d5f279fec7031bf81ab5a74bfb31b578951faeb14f7917e33de1370754
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 87.4MB
        • SHA256 32b48d5e24776a655ed3761060a7337a5d1ac9b9702a890cfcb3b585fcb52378
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 86.8MB
        • SHA256 52613c37aa6bb3004d6137a8d9c18f413d52ccb27bdf756b71ef7dbb0d81f74d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 87.2MB
        • SHA256 a10cca5f689a591044af99849b727012f64a7cbb6e1278a627e359529bc22257
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 84.0MB
        • SHA256 b68b2e7c5e396716cbecedcebebdda5c383f13caa5cc6670c3b3eea6aed3057f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 8.7MB
        • SHA256 e406bcc337828158710f3351684fd5e02fae37e07a2255fb169109123156b53a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 6.4MB
        • SHA256 6349f8bdba0b2ff6cd62d2f8d9f3c55493b7a45646f1ad42fcc0b75986dff72d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 5.8MB
        • SHA256 019979eb42fa3a9d2d4925594f522070c3e418c9496f5290f17a3bfe2ade0088
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 5.6MB
        • SHA256 6537688623ab7754e6d2ffbcaa7687a483db6a0a5a3e0d9bd8115e878f6aa894
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 5.3MB
        • SHA256 2df1ae82fc52e7f22a21d0ea587600453493b8d654392a7db18755dbeeb33640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 4.5MB
        • SHA256 b9b91a9d731fbb7427af547deeef32a9d53a8932746e56af30daffed6a22b68a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 4.6MB
        • SHA256 d97dc8f3574f862459c36bf1d3a69bc433a12bd115ed4dd060c0b7618cd5fe2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 3.9MB
        • SHA256 b1983cf54af306f54fd672cdfcf6c2f942b3459460b221ed4e88b48d710a7590
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 3.1MB
        • SHA256 384f9dea08fcb058852256a8153100ceb300811e42625a2007283f50354dd91a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 2.4MB
        • SHA256 50f76a9b61cf63eec72bec3b8c8d4e50d23184d7672e1fcfb95759e72ad96941
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 640KB
        • SHA256 86e597f59f99037f999f4cce49f3c789a91ff9bf15b80949453c5a08133aa473
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 93.3MB
        • SHA256 05064500963721c9d24462bc6ed0f7030c5cc1785d8aa3ef9c4c9ba26bbc008a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 93.2MB
        • SHA256 73adb8f225ad081061ad328c75bcf99ffd1d53132fef8bbd24dcdd1628346965
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 93.2MB
        • SHA256 69afaf2e2b8b0dac037190b900a41d04cbea95c6780a556e42362ce59652281a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 93.2MB
        • SHA256 78401a771c19ac6830e14368a8930282f2a44530d3104c782f0b7167344fc2ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download