Overview

overview

8

Static

static

3

2026-08-21...ar.exe

windows10-2004-x64

8

2026-08-21...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 04:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_9d12382911e5fb7f01f5f31c2e86f3cd_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 19.4MB
  • Sample260821-eqjk4sseqe
  • SHA256 c6e693cbb3cf4d8bf44e25125f64baa081482444259dbae0dcaa453cb825b028
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_9d12382911e5fb7f01f5f31c2e86f3cd_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_9d12382911e5fb7f01f5f31c2e86f3cd_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3448
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_9d12382911e5fb7f01f5f31c2e86f3cd_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_9d12382911e5fb7f01f5f31c2e86f3cd_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1132

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 19.9MB
        • SHA256 b8fea2627358818b14af403a379625d4462704c5adf4fbb237f707118106128e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 20.3MB
        • SHA256 e1e0c5f9147b31f5f1c46f7fbca2d928063e7e7fc2fcc8c6ba19f476db511616
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 39.4MB
        • SHA256 66733f866fc0b180b2d5a7a83538f0b7ab709fb310a97ca9966f6e9b03beee8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 38.8MB
        • SHA256 81e157375a17cce4b609f3e370c578ba4dc1fbb7a82a1d9d5ad59175c09767b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 19.4MB
        • SHA256 c6e693cbb3cf4d8bf44e25125f64baa081482444259dbae0dcaa453cb825b028
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 19.7MB
        • SHA256 44d7161e2ef757e752fd251fa86b23156889d776d4cb09c88a602e6ea3a9fca6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 38.9MB
        • SHA256 09d8613ed8b277bdd43acaf61d5672e1e4403fa1eb635e8d5e95526865f66d57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 21.1MB
        • SHA256 b20ce8878b1b447341cbc686641fa8f818ac9a5ef01fdc1d53c42e5bca97fcc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 42.2MB
        • SHA256 fb1321b858d54902ea5177a05ef146680acecf780312ce0f642468a111a386c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 41.0MB
        • SHA256 bde95b3cd37f6561829f04f7db1a4293e85292b50f22c4fbbef2320f6e2abc0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 40.4MB
        • SHA256 7a36e25b126c7854692d02cf621c7a119e06ab025cb2a621cc7b030ba01afa53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 21.2MB
        • SHA256 1aa214ad4d02a6e6083b598aae2c7fc03bce3b0a732a58abb9efb036849fb29d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 38.8MB
        • SHA256 067547d19b31a34dc971150f9ec4e4b09ebc8e37847893fc7698b55069cfc62a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 38.8MB
        • SHA256 16f55b9ce2a1004da2cb16ff2f611578763fd48b414baae15fb3535c8b285732
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 38.8MB
        • SHA256 23a87eb988788f02817799b124c4cf9117d4175b55cfdc8f23263ab4504478e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 38.8MB
        • SHA256 f50e055d109c8683c1bcf777c6e7c6271fe0a9401895d549f177323edfd16337
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 38.8MB
        • SHA256 07663817e5c20c5e5fdcc43236e3ce44c2bfbad517f164538496dcd73866f8de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 38.8MB
        • SHA256 04e257c0666bf5407f4ad5f199948edc8d881f53b0d47647707c8842f4d9d839
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 38.8MB
        • SHA256 ecafd867dc0d4ea9f291df0627a97810c87b36edec071a7565b1c79112ce9447
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 39.0MB
        • SHA256 46b85aafaa30d6ca445e675d66718cd31536160a78a9b57e5b99c14427ced7f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 38.8MB
        • SHA256 cf14f3996c77e1ad2416d8744ba55a3e84f9ccad1426fc7d816a110319412e72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 38.8MB
        • SHA256 df4425a8621392822acb1d6b8dbaa69370013692ce350819e795e41741ad3094
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 38.9MB
        • SHA256 b5ce93e5d549be00caea3aecf9cbca257108a603c19118b036a2b159202f8f51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 38.8MB
        • SHA256 336628cbed71a39138c33effb37977cfe53a76031f49f0856081fbea24f4324d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 38.8MB
        • SHA256 724304ecfffd46beef7dd5a36ddae7806674c3b4715005e4de27f51ca5a8adf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 38.9MB
        • SHA256 ba8c74624327b892c9cb524438a8a31e23f3ce2c4fc937058cf3edd7634d1627
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 39.0MB
        • SHA256 b7f716d0b809d3b182c974a98b5f5a7bafbc0d9a36cb9a2be4dc35b20e521cae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 39.2MB
        • SHA256 9d74c26448d1e04df2bb04fa815977459397f90facad0c466a63f5de4ab2d5f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 38.8MB
        • SHA256 6b9706b47bce4abd61c1998bb4106725315f9cee339192ec8b5c9b9f8d624e51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 38.8MB
        • SHA256 c9a8a2516e7ce712618779cf4b41a58567d02d4841d1559dfa501c8ec0aaa3f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 38.8MB
        • SHA256 bf8f7c5c28f6d58b5a2bdab13545cbdea4aeabb2e0b014c3aaed09ef50e501e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 38.8MB
        • SHA256 01f457a81e76b52b85b6f75fb5bb36d22e75982906ef6873fee3eb8d278b1ead
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 38.8MB
        • SHA256 0898b856269cf67df3315492202ff7a6e8673ea12ba957f5738e384e98a01601
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 38.8MB
        • SHA256 da7041a65a53afc6750d55a0e4344b2a74581284ebe0ad932bcef6286ab4a3d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 448KB
        • SHA256 a57023b48e2e2821a5111ef2083874cca8f0a8deeab6a8ebb48cac39e5e2482c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 38.8MB
        • SHA256 b7d12681ab2e682718c1b73a26b3a89c64f03911747c1736dc5a3c13528d5036
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 38.8MB
        • SHA256 571b053d26b34d121af8f5ef8f8d3fe4066595e731873639cfea1a738d3f78f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 38.8MB
        • SHA256 0209470ba87d4ee0ad7942f04a899eecd3e09b9f6fdbd230c489329a94826e8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 38.8MB
        • SHA256 ce414708e6f1941805fdad237027e7eda2f9e3b1af6851e96bb2f0d6d61c2e53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 38.8MB
        • SHA256 d172a6e47ac340ed991ffd4a336fd30e592f1a1055ebff9cc7b9f620bf085df5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 38.8MB
        • SHA256 4d2d1297762bd30dc160210e7cbb51bdbd858e165902f74e23fc48d9a16afb28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 38.8MB
        • SHA256 8d389831a5013b7fbd5592945d37da911e1038daa59fe3195f03b0874f86dc25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 38.8MB
        • SHA256 247644a2dbaa52bef99f92c711c34f0402d0870f0711270941b8f5ceedfc0a8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 38.8MB
        • SHA256 065eb02f0323957cfbb1e56bb9f236cbb963a858f40f9f06109977dcf2f53db8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 38.8MB
        • SHA256 2ff2d8723dfef18769fbb7786ee6198d5c5d2d59d3b1004d98903859b9b65590
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 38.8MB
        • SHA256 b2961699cc3bbfefebf0f82ea89a68ecaab70f3ec329a368ad20ebe78bff074d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 38.8MB
        • SHA256 2e4d65e82497df2ef80e4212c8af602e12ae78cdc51d9e18fa8a84e3a4cfb6c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 38.8MB
        • SHA256 000eb6d3dce99e2f615a051459d2a5734bf31e276ea2561eff5237792e01c2c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 38.8MB
        • SHA256 cee9ea060bbc5f662e11138aad845c1f8d9b1b42588750280d88adfb4bdf59c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 38.8MB
        • SHA256 27ed0f1a4b35f57b351ed99173a7feac8683c347f8415eca40c5c88b27e9c36c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 38.8MB
        • SHA256 bffc3b505413dc506463b52930005453a301fe907b165902ef64779f5f286dfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 38.8MB
        • SHA256 be5513f67c06e52f4728a71d7bcd8f44e8cd54ba836b0c9f05efd9b5c932cb92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 38.8MB
        • SHA256 2b318434850ed90ed7a8f646dfb4e093766b4a42efdb384d7b3e74d0316f5847
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 38.8MB
        • SHA256 82a6b2f54374e76bf1a6c49d70a14af188dcdb4a0fb5d79bb7c6d118a6327117
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 38.9MB
        • SHA256 d74b6e9b849ea5b1d279dcb41108d0195d34c452bad6238bf394bf9b48a8996c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 38.8MB
        • SHA256 cbd8cf3677eb1c8eded7896cac64f7db5bebece79e667b5a4edca78e1ff7b3e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 38.8MB
        • SHA256 d3ffed788e92cc1885bc46c863d94973466ddac25537513d9dee331945623c38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download