Overview

overview

8

Static

static

3

2026-08-21...ar.exe

windows10-2004-x64

8

2026-08-21...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    21/08/2026, 04:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_9d12382911e5fb7f01f5f31c2e86f3cd_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 19.4MB
  • Sample260821-eqjk4sseqe
  • SHA256 c6e693cbb3cf4d8bf44e25125f64baa081482444259dbae0dcaa453cb825b028
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_9d12382911e5fb7f01f5f31c2e86f3cd_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_9d12382911e5fb7f01f5f31c2e86f3cd_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5016
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_9d12382911e5fb7f01f5f31c2e86f3cd_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_9d12382911e5fb7f01f5f31c2e86f3cd_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3772

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 39.7MB
        • SHA256 5b9f91b55e6a0d1692d073c0dd240b0e6308fbb94e0709d714c1c3556a09087d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 39.4MB
        • SHA256 66733f866fc0b180b2d5a7a83538f0b7ab709fb310a97ca9966f6e9b03beee8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 38.8MB
        • SHA256 81e157375a17cce4b609f3e370c578ba4dc1fbb7a82a1d9d5ad59175c09767b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 39.0MB
        • SHA256 ee9c9ccd5e2a1fbc425d823f21461d27ca0d8c3bc7a2a0c542a491b98bbc7674
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 38.8MB
        • SHA256 b4331c422f8dcdb41ba1996aee5c903496baa3821794427aef95e5cf1c772916
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 42.9MB
        • SHA256 5e2ff1bb06623f7fcf654cd2570b9e05a2400f3ec7fcfeb709a297e5fbbcf212
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 39.1MB
        • SHA256 ba512e555da63359adb4e936329af5e5502ad274b0605c3972766e8befb3dcd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 62.2MB
        • SHA256 348bc468f6ed33a37a53c106cfdc6f3ebf4951531638107158fef2992cc743a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 38.9MB
        • SHA256 09d8613ed8b277bdd43acaf61d5672e1e4403fa1eb635e8d5e95526865f66d57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 44.8MB
        • SHA256 5f44b672fc05362847c57854ac9b150ad31402f6b0fb87ff02b6492036a03a81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 40.5MB
        • SHA256 f2aa4334f19743badd32da84858cc5946017a92e143910328fce3be84fd242f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 42.2MB
        • SHA256 fb1321b858d54902ea5177a05ef146680acecf780312ce0f642468a111a386c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 41.0MB
        • SHA256 bde95b3cd37f6561829f04f7db1a4293e85292b50f22c4fbbef2320f6e2abc0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 40.6MB
        • SHA256 9ccc773a264d86600ff59187c7a67209a0bedc53eafe4f03403e564f90e41bee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 41.8MB
        • SHA256 2c4b96f96ee28c3d2afc3910294115f59398eb4369f3b4f0b40a0c8727b8ecc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 40.2MB
        • SHA256 063ceb18a6533d4f7cfe2c1ca1da748e4a3aaf576d2ce72a2ae080e0553ab657
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 38.8MB
        • SHA256 067547d19b31a34dc971150f9ec4e4b09ebc8e37847893fc7698b55069cfc62a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 38.8MB
        • SHA256 16f55b9ce2a1004da2cb16ff2f611578763fd48b414baae15fb3535c8b285732
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 38.8MB
        • SHA256 23a87eb988788f02817799b124c4cf9117d4175b55cfdc8f23263ab4504478e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 38.8MB
        • SHA256 f50e055d109c8683c1bcf777c6e7c6271fe0a9401895d549f177323edfd16337
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 38.8MB
        • SHA256 04e257c0666bf5407f4ad5f199948edc8d881f53b0d47647707c8842f4d9d839
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 38.8MB
        • SHA256 ecafd867dc0d4ea9f291df0627a97810c87b36edec071a7565b1c79112ce9447
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 39.0MB
        • SHA256 46b85aafaa30d6ca445e675d66718cd31536160a78a9b57e5b99c14427ced7f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 38.8MB
        • SHA256 cf14f3996c77e1ad2416d8744ba55a3e84f9ccad1426fc7d816a110319412e72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 38.8MB
        • SHA256 df4425a8621392822acb1d6b8dbaa69370013692ce350819e795e41741ad3094
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 38.9MB
        • SHA256 b5ce93e5d549be00caea3aecf9cbca257108a603c19118b036a2b159202f8f51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 38.8MB
        • SHA256 336628cbed71a39138c33effb37977cfe53a76031f49f0856081fbea24f4324d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 38.8MB
        • SHA256 724304ecfffd46beef7dd5a36ddae7806674c3b4715005e4de27f51ca5a8adf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 38.9MB
        • SHA256 ba8c74624327b892c9cb524438a8a31e23f3ce2c4fc937058cf3edd7634d1627
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 39.0MB
        • SHA256 b7f716d0b809d3b182c974a98b5f5a7bafbc0d9a36cb9a2be4dc35b20e521cae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 39.2MB
        • SHA256 9d74c26448d1e04df2bb04fa815977459397f90facad0c466a63f5de4ab2d5f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 19.4MB
        • SHA256 b227e4f378616b1521ec38c556a375d03c4ada1338c2a07fbb9001de06bddef2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 38.8MB
        • SHA256 867c17c99489dd831893701545667c9540a5efd562d54d09f8cc965feb3eff92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 38.8MB
        • SHA256 bf8f7c5c28f6d58b5a2bdab13545cbdea4aeabb2e0b014c3aaed09ef50e501e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 38.8MB
        • SHA256 01f457a81e76b52b85b6f75fb5bb36d22e75982906ef6873fee3eb8d278b1ead
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 38.8MB
        • SHA256 0898b856269cf67df3315492202ff7a6e8673ea12ba957f5738e384e98a01601
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 38.8MB
        • SHA256 da7041a65a53afc6750d55a0e4344b2a74581284ebe0ad932bcef6286ab4a3d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 38.8MB
        • SHA256 2bec01b3086bffcdd1d68bae73c566f0a4fe1adf3a72615f1d86c2af57ead9bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 38.8MB
        • SHA256 b7d12681ab2e682718c1b73a26b3a89c64f03911747c1736dc5a3c13528d5036
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 38.8MB
        • SHA256 571b053d26b34d121af8f5ef8f8d3fe4066595e731873639cfea1a738d3f78f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 32.4MB
        • SHA256 c1fa46321cbc13defb0b21230f4827d6bd005d78cec9a2d9d8828a2344d1f92f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 37.3MB
        • SHA256 874f5a7281047d31c2bc90ec0c3bb8d0307d5b826cad68b574f898912d4d5282
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 24.0MB
        • SHA256 df65014cf58b729f68f160db628f9a309d5f210915972c00db1fc9c3ff7240ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 24.1MB
        • SHA256 29de510b7faf9844168276bc8690cc942b7ac9e12cd36ee1ee9ffdd46c98c87b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 23.9MB
        • SHA256 140c0b63f8d6762b97b055c31274a6b33281cf2c1fd2eb9865425ffee97b86a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 24.2MB
        • SHA256 248c28ac58e259f77ded2525a65e9d69e6622846962f0d0f164000baa845120f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 14.4MB
        • SHA256 a26dc60ea9136f6df8eb53489a92fc5144cd4d4f25e30b65411804b14fd3e609
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 8.8MB
        • SHA256 45cca75ab220db1730686109b61697a1b9b8a9b412945e383c2c639cfc9fdd06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 8.6MB
        • SHA256 5a75b72d67e56095b31d3399a7d08d0aa516a292fae00bcf24ff8276c8d26498
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 8.0MB
        • SHA256 68d33115cadea8356ad26e832d271f8262133c1069f317ac2ab8df354883b379
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 38.8MB
        • SHA256 8abbe31d19c03c5f454036442e5edf3049fac0a6363cfab6a9911a8fc5a6b0d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 38.8MB
        • SHA256 cbd8cf3677eb1c8eded7896cac64f7db5bebece79e667b5a4edca78e1ff7b3e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 38.8MB
        • SHA256 d3ffed788e92cc1885bc46c863d94973466ddac25537513d9dee331945623c38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 19.4MB
        • SHA256 c6e693cbb3cf4d8bf44e25125f64baa081482444259dbae0dcaa453cb825b028
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download