Overview

overview

8

Static

static

3

2026-08-22...ar.exe

windows10-2004-x64

8

2026-08-22...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/08/2026, 03:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-22_a4bdb61af7e9007304480a54d87c17c9_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 8.3MB
  • Sample260823-dvyedshb87
  • SHA256 476253da5b17b48d65809a36c6e967b306decefdf4d2b80399a20cba4deae7dd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-22_a4bdb61af7e9007304480a54d87c17c9_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-22_a4bdb61af7e9007304480a54d87c17c9_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3452
  • C:\Users\Admin\AppData\Local\Temp\2026-08-22_a4bdb61af7e9007304480a54d87c17c9_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-22_a4bdb61af7e9007304480a54d87c17c9_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1492

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 8.8MB
        • SHA256 912b64fe4352f6843cde24254216e57408dfd1b1256030b689804c578bcf3d67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 17.6MB
        • SHA256 90703f6a773eb8fd15bf8977987c0c8811b425a7b9577ee42eec27b59cb74821
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 17.3MB
        • SHA256 644402c43d03313af4c12a4a227442a5d67862e0c77116d1b364712fb68400a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 16.6MB
        • SHA256 03c698cebc22d58fc1be3cb53c928137a8ed9fbe7a312b5f86b42fc412356c50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 16.9MB
        • SHA256 4f82acccb14d0d925f067bb80458679a41d3aba40b104bf290825a55dbdd5963
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 16.7MB
        • SHA256 74591fc25966de576873f37e8fac0dcc2cc7c0d5225880e8608d34dd0ff514b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 20.7MB
        • SHA256 6f6b12c35ccd177d3bcc6d79671b8eadddd12ce763fdbee7111479555f809ab1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 17.0MB
        • SHA256 b00520511f259e4ff88885d5d88806e8dff180dbd352fe06b44719d5999f93b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 18.7MB
        • SHA256 4753c8101d47822ef217f861e954cd1c7d21d5be15965e6e21f5d997baf57490
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 16.7MB
        • SHA256 71597b120fd69b6013fbbf0b90a860f23fee090909ed41c55b223a65c755a749
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 22.7MB
        • SHA256 ecc1060f3eff48ed5f1ff5a84fe1b12ef6b6214034ea33ba5d5b98060fa65f7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 18.3MB
        • SHA256 193aa9816504857363236d76a93ca968ae5e6f2a33454a546124e9d839251071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 20.1MB
        • SHA256 36ff622cfefb9287b6536d0afbdb53eb30a13607349febffb01a39875a88b0aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 18.9MB
        • SHA256 2afc27c2756bef54de287fcaa42cb4f61be4b6bccc705ce23e0b4153fb794e17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 18.2MB
        • SHA256 47420b334443e632e608879c8daa0371c2fcc8390adb536fe44a3af72661e8e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 18.5MB
        • SHA256 77df186f57c334d35c4e89e513448e5ecbdc799be19b21ff932519500cd5d44b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 19.7MB
        • SHA256 e3ad8424dad5453ad4f74f1cb8cf945df247841a38c9d4c97366d2aea6527741
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 18.0MB
        • SHA256 cb26ac8ffdbf1683dab3c5737c9d1ed35772753e89702f47eeb81d37c8f50c9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 16.6MB
        • SHA256 3a742cd720e8c85d71e834a3dcf0da164bd909c06636e409774360f43be2d206
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 16.6MB
        • SHA256 c51bcdbb55e9a3e7f71b4c861457e153880343b3e6f5e7b8f55374364c53797a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 16.6MB
        • SHA256 ef5fc22d03c690bc3c60ff699c7a1035d9ca56921de456c0cb1ae8891ca21cc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 16.7MB
        • SHA256 f2afbca960d440d6a200efeb82e59137cf362c9d3456735bdbf68a26719186c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 16.6MB
        • SHA256 0bdfe7af027862ff83f84bf9df37949532ed306ac343e0bf005bcd10b9661615
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 16.6MB
        • SHA256 c798a20aa1fbecfb26945ff72b63841163fd1932434ca06e9a5a609f3876bb8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 16.6MB
        • SHA256 386e05dbb7c859d31e63febf6734ba355d89be2cb023f1edab360666cafd0f97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 16.9MB
        • SHA256 c3da1413cc65b674e8a72d5cce0a7dba8bff4ab99e4a4707af88296ea9999cba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 16.6MB
        • SHA256 16ea30bed3d00c335f13363a8493506153d13e0c12ac02b19369656a730a772b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 16.6MB
        • SHA256 38244d2dd7af142fa644adae0b83c1d0d2575262a325da82b4769c923fa0bb03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 16.8MB
        • SHA256 07b4d6d4908189b764c5e8812412a44484cc3201ca7c5973e3f8fb48c7f1db52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 16.6MB
        • SHA256 1d0662d5f836cf97ec99e2eda791605b1fb70251908d4cf855841b642fa15970
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 16.6MB
        • SHA256 070571c08c3ff5148408321c7d4f1b896da7194fcd250f789390482ed5c6b17b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 16.8MB
        • SHA256 4f6147c82a0bae81ab90d98344c6bb79fcb08a44f62edf870f28e6c510efbb82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 16.9MB
        • SHA256 1ed685e892a2f926440ae0ed4b2b730c709b305a8455c3bb957589489d202c0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 17.1MB
        • SHA256 d7d489a3cdd192190cd84c18cc96fad7a70a3e39587174617231473ccb43be5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 16.6MB
        • SHA256 85c1a23fb7121227f4a6a638816eb9fe57449eda713e9dbeee4ca341921eeccc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 16.6MB
        • SHA256 606d76105dcfe0508c50d415c5e66b1b4ff47b481ae37eb3c26abb87423aab71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 16.6MB
        • SHA256 8ea3eee7df0665e109e80b25f363ea02224245c4a78404599219ca8db4898272
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 16.6MB
        • SHA256 83829727a148899ae22af1e4bb8e63d4b82fad097dbd00e97756f9280f861e3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 16.6MB
        • SHA256 23af5bd5ab7db3e3d67b405d0c569cc396055b4abd6d071c1c31978259353f13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 16.6MB
        • SHA256 8cb2fa8f5d883620ebcbf96a8ee16b8cccbc0cf07b79ec9fde2df7d4e43842bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 16.6MB
        • SHA256 c6d56c85cda5aa74bd522e0f6ff2048dd393b95ec7351bd5cbd55f07cbf746b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 16.6MB
        • SHA256 4545f2b64e2fa140c7837ec056675552623f5898ac1a4d105c587e9ae6da102d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 16.6MB
        • SHA256 e720edabf1f73bd3b6c37aeaf87d74eef175159e7bb1e6ec0dd33ccddbcc6c63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 16.6MB
        • SHA256 358e91990a730666f41e0a2d56d2239fad20a58c055b9933646745383381f8d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 16.6MB
        • SHA256 e85a0faac1c39c89b5d813674d985440398b668d49063b698c4d08930a4967c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 16.6MB
        • SHA256 ed0cec327e07c2457d5dce02362eed111d3f2eaae3edadd89032e3587f1c8d93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 16.6MB
        • SHA256 bd72b3ea0254f3a167ca371030c05924b4e3c93dcc0abdb943689f82ea49966d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 16.6MB
        • SHA256 c7a8b7194d1aeec16cc7a959b886220a5f513ef9909c876b5a52b19b49a064dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 16.6MB
        • SHA256 0b4c4f25f9cbcb1726167d8b48ee4335a4f911592382682befeeb3b938aa053e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 16.6MB
        • SHA256 3b2a5e02a9bf81ab2407071bce2337cbcaf51640aa43cbbb7bf9aeb11734aaa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 16.6MB
        • SHA256 a05693a066451bf17be9c8c691e3c5a5fb549c96eef78260072024ae16accfec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 16.6MB
        • SHA256 fb218aefeb8a3f6914dc68581e33876a7d67f9e191940c85f7b5f8360334d587
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 16.6MB
        • SHA256 84f61658ff6f5e1cac56c5d92d5b012a43d5ee668225c74f6e9ce98082777e36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 16.6MB
        • SHA256 af44185119d88f61064bc74fc130d29b9956bacd59f217c90776f93246008621
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 16.6MB
        • SHA256 c05e60cc7ee498a9379df0ac0ab30bee0b017828503933230326fb4ed7e3728d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 16.6MB
        • SHA256 113dc288b9f0a61acd7488b2c0dd7972ec394aa3b32d4ef0b6fdac45e5b56694
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 16.6MB
        • SHA256 46944626dbb8d581a03fdd0a8af95fbdf860c798e4b5004cca095ea646dfdc67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 16.8MB
        • SHA256 419b6f0bb7d7519409d0c928cb870daf783bd086b7249ecce16016897c7a2b7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 16.7MB
        • SHA256 aed1ffb4e19129b2091bc8205f2de80421c8f58687d0058e04b53a35a93b430a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 16.7MB
        • SHA256 d09e7cae48831f532d813ff5978a17cae3966324a3401ca6d8cef2fadc71e8aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 16.7MB
        • SHA256 0cd32165b46c32a95eb76c34e2427b20464c7acc60846f8818906d2887fd566c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1492-30-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3452-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3452-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download