Analysis

  • max time kernel
    149s
  • max time network
    113s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 10:51

General

  • Target
    2026-08-21_8c0a92617332309fdf3871174d14335f_akira_cobalt-strike_elex_emotet_hijackloader_icedid_luca.exe
  • Size 6.0MB
  • Sample260822-mx374atcld
  • SHA256 3da50697c91af6400b861af08a691cbca5ca93028e939cd9fc2453de7d863e0d
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_8c0a92617332309fdf3871174d14335f_akira_cobalt-strike_elex_emotet_hijackloader_icedid_luca.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_8c0a92617332309fdf3871174d14335f_akira_cobalt-strike_elex_emotet_hijackloader_icedid_luca.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4332
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_8c0a92617332309fdf3871174d14335f_akira_cobalt-strike_elex_emotet_hijackloader_icedid_luca.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_8c0a92617332309fdf3871174d14335f_akira_cobalt-strike_elex_emotet_hijackloader_icedid_luca.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:908

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 12.2MB
        • SHA256 e1cc24ca3f4cf4cf008f54575c63dd224cc3e8f6f5045165854d20d1d962df2d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 6.0MB
        • SHA256 6d9f3b4ae9cbc5f19c3998104f126d93fa1c064637a9c77108f8c6867f7f0b19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 16.1MB
        • SHA256 390be605782a9c9119b974b0058eb027eb13bd7c8a96cc950406bd3d7f99f4a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 12.3MB
        • SHA256 a4800149b8107914e06a47cbbf23b0a93fbc36ee9e055968008691aa3c887894
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 35.4MB
        • SHA256 5fdea3e4ee5f7888653627188a8bfd31cd15ab0530ab77ae450ac0e0a351c493
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 8.1MB
        • SHA256 8dc594ebe9b32b18d77a2a1d31fee89cf81418afe6623d444fe01896eaeb3d65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 12.1MB
        • SHA256 1458ed6b901098efa0879df68b4cc7d6ad9fc21ad746e9851f70df810f2eadd8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExitResolve.asp

        • Path C:\Program Files\ExitResolve.asp
        • Size 12.6MB
        • SHA256 08beb8735fa0ceb4966771ec9f571f096601043a7b7150b8ac2c364cbe277eca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExportRequest.exe

        • Path C:\Program Files\ExportRequest.exe
        • Size 12.6MB
        • SHA256 ae69be908dd448f2a4663ac2270dd9bb2aeee48d8dabb03f135466a82740ef8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 18.0MB
        • SHA256 a54ac9dd19913c62becd3c3f2a91e186121b3149f19a9c029557b176aa7de37b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 13.7MB
        • SHA256 a434fefcd4e05eb62da766c344661af35a11c7f62dc1fc65180054e3e2b96f0d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 15.4MB
        • SHA256 31f66f6f945914e857e6b8718958b73a7e56f406d7c107beb2bc4e3a7d539faf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 14.2MB
        • SHA256 87fa748f2ef4c54102ae70c89be8f6f8357a894dbca5964f996bbb7facad4520
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 13.6MB
        • SHA256 4fcc23428a529f599f771b5168deeb9853e65b8cc5c68b06152d3691e674d3ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 13.8MB
        • SHA256 df1593176d9ba45ef7fa3540d2b0e15b797cecfdc33647fdb220fffdc5c9763b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 15.0MB
        • SHA256 160cac28f87a9ef865e14e6fdeb7a88be44e5014b9ddc8cbeeb6ad36646fbadf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 13.4MB
        • SHA256 cd67652b407aa99f57742b0a4e7616f1e21e00499d72cdbff3322dcd67e08907
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 12.0MB
        • SHA256 926706ce155e7277d46c50d248206e4b8944d4d436aa160b5a57d323ed73d2a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 12.0MB
        • SHA256 d710e59a3033b04b7b1b163d1a95e9d6afaee98f94bf1b95e3e2c638dd213138
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 12.0MB
        • SHA256 6349632e90704f57133d9a8b4d2f923ecf181f56dcca443b656e472d9e2fa0bb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 12.0MB
        • SHA256 1fc053f2e1a6daad7e688f93ae581b1933965db6daef7f731f10d968643a2f39
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 12.0MB
        • SHA256 d0e20091d98553adbc416bc292ce404f4f988a268e5f1ad6c501d84977aa172b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 12.0MB
        • SHA256 2bf54f3c21e65f6a15edea5747bed4d14a97b28e41bcb9df5f06b9a3ce8ab8b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 12.0MB
        • SHA256 7d4e66169bcba459b9def547210999b8c6dc957628bb1cf14070a3c14ea55f97
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 12.2MB
        • SHA256 6ac51236701ecdc1f361c256a1e34aeb291f006e0a1025da17188f04f5574337
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 12.0MB
        • SHA256 aae587d6955033bc7a0a70c2fcebc945801bcf2e0853337c34a5379ab0e2c7c5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 12.0MB
        • SHA256 319929035104217a3167b9414a7d4a8d80b05c113ee28b00a81c9bbaa8699bf6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 12.1MB
        • SHA256 2ca3011cc32e75cd0d07be998610d9dab725919f2fe8161de42709ab861c3a09
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 12.0MB
        • SHA256 815e88093eb46671bf7bfe3a4dfd73b06f8b3b3d4ba0f74b5d0f58a2bc8546e1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 12.0MB
        • SHA256 1be1a411765fbb3d630d7c5d6037f61a1f4e4364c323c0cf907c9ca91cf8913f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 12.1MB
        • SHA256 19ed3969a9e03be2298767a0839052622c78180b74432f4d2b6511bd6b3c3b52
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 12.2MB
        • SHA256 8bc2e6cadab36a77cfdb08217301d94f9bff8e93c796ef3e8dd82fb17310b581
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 12.4MB
        • SHA256 b049d75112443e450492c571f8bd9b380b64b78edfa4b0441e2ff1b16aaef52c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 12.0MB
        • SHA256 5693fcdd338683a61d20fae0bf3103cd61bc5f3ee8fc24adfa769a7d724bafa9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 12.0MB
        • SHA256 fea208b85a4b0b14a6aebcf1d29120c031696a464d82f022b87ea83e06ab9ca6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 12.0MB
        • SHA256 3e11caae1435c5afa44035e911f56a644d841006ad814f14ac082b6a95e94020
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 12.0MB
        • SHA256 7e2ead6d7aff32ee04d2a981cd6703ef874e6a3e6e3c232e0e6fb2bc826f7622
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 12.0MB
        • SHA256 19808fa5f06aef4b7b71706743c4eac146b9ce19a61178357c211cee20f73baf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 12.0MB
        • SHA256 79ec4cbc454830490f0727e1703e70df1140da141b38c6a44b403e178488bba0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 12.0MB
        • SHA256 057284f71809e9027d20800e98bea6cb792cbb443b944a2aa02599b7a32641eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 12.0MB
        • SHA256 5344ca38766a94ee047e0c6062629db4dabd68046c909c348c97f9f099f38a69
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 12.0MB
        • SHA256 f00abac86165a7bc9cf8c3ebb7c99361dfe53d318188b68bd50be414c43dd445
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 12.0MB
        • SHA256 b328f0b3903e0c25ac01c63de60bccf543990d11400d48f08c3064a7aedc84b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 12.0MB
        • SHA256 b89c46d0ab07fec56d157e6016bb39830453a878a478473a4ae6c73c7da7a994
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 12.0MB
        • SHA256 4ef697f16adf1cfd2974e5b32fb81e4f0007713d6d578809cadf62fd9d2f7e0f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 12.0MB
        • SHA256 35d60688dd9b21e1ce476c5dc0d8a945fac657add8714226120763bc7e98ef23
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 12.0MB
        • SHA256 afdc5f864d7fac489a45d541e5b471887e16db0051b98bc25b3b2074e1800557
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 12.0MB
        • SHA256 04297d93f75fbd29703dc941ec3cad429a0a1677b394e82fb03c51442dec6dad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 12.0MB
        • SHA256 34f9c4312935aab071db0de3b5cd3338fab94d5f8cb69121b671911a306a8212
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 12.0MB
        • SHA256 61e788139e7644595fa9862a0118f4ea96904404614029ded1167157661bb053
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 12.0MB
        • SHA256 d309882979e8a45fb3e78215c088c4d1283244463571dacdd4aef2c1df3c43a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 12.0MB
        • SHA256 7b03d56f192b096e7d1d8b617c7868f58820f0a4fb789bd3ae8cdba8d3da2ac8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 12.0MB
        • SHA256 273d86810d96f62cb38d3d6317ff042e2151802191032186d425d9eb6c1344dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 12.0MB
        • SHA256 a6be8e79280d123b3ea459d6ef25e6955d3a0969bb70e67d5bb8bb33340ffc68
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 12.0MB
        • SHA256 cfaa828dc9443b40fe8af1579374c417d8eef56d22a3f4a91aeb989964099b5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 12.0MB
        • SHA256 3961e65957f5d31240cfeca0423bc5e9c68b5f4683a96f5db71c1649941e3c48
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 12.0MB
        • SHA256 e7b94a92402d77a5a7f65ee738a1e75294004047e8e07edc76c3545bbbbc692f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 12.0MB
        • SHA256 c01524cf80a114db1b9b3d9c789e9f25ff09a682bf67c8f51e6a01b3b861bf00
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 12.0MB
        • SHA256 8643ae94d579324faa79e9c2eb5a1ba8f38b495ecba309b460cc2fc347d4d53c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 12.1MB
        • SHA256 3c98092c72d4f4ebf81488bb8b5e3d1a023bace5ecbc01f6706e3891c79e8604
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 6.0MB
        • SHA256 5481b210266af68550aa1a133c30d929f80697a9fa1b2e751093a7d254e9a44f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 12.0MB
        • SHA256 6f9d4d013ccb9a7c075d4c29944771df55aefdf0c091167495933ba5bd41faad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 12.0MB
        • SHA256 f3ef423dfe6e43df3b52255d6d4f33fd880d05d22e72f04c37d15da7a3773803
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/908-35-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/4332-0-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/4332-1-0x0000000000400000-0x00000000004E4000-memory.dmp