Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/08/2026, 15:07

General

  • Target
    2026-08-23_f773e5127ba5f90a422e0ce136e3ae75_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 9.4MB
  • Sample260823-she5lsaf33
  • SHA256 d07898cc1801fee211c6cbd763f86ff688139ebf5f9ceeac0fc876afeea9a062
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-23_f773e5127ba5f90a422e0ce136e3ae75_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_f773e5127ba5f90a422e0ce136e3ae75_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4684
  • C:\Users\Admin\AppData\Local\Temp\2026-08-23_f773e5127ba5f90a422e0ce136e3ae75_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-23_f773e5127ba5f90a422e0ce136e3ae75_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5944

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe

        • Path C:\Program Files\7-Zip\7z.exe
        • Size 9.9MB
        • SHA256 cf2df846ea21a6a6521890fcb7cf54f86c31e2dda607714a648f139a2a5ed94f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zFM.exe

        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 9.4MB
        • SHA256 d07898cc1801fee211c6cbd763f86ff688139ebf5f9ceeac0fc876afeea9a062
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 19.4MB
        • SHA256 bbc559bafe2f9aa6c791cd14d4165559618560e4e73d0b27c3f6c592942ceafc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 18.7MB
        • SHA256 7edb4ce994b0f617f14f42bd538fe2cecf3fe18d993dccfdc2a02ad6559252c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 19.0MB
        • SHA256 4a6fc4d4a92049d1526cf25dc34d3f828fc97ae05a6dcf0c727eccaaa09dcbed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 18.8MB
        • SHA256 d1c9a5f6959d068e472bc63d1802d6e39019b6a7a2132d8451283820d3ea3e4b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 22.8MB
        • SHA256 1e255f3aa724020ac70bc7a85f5864130275346a2ddb01d30152ba630ade3b4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 19.1MB
        • SHA256 f779bd366fbdf575dee8fd97fc0c167932f074e51da5cc82cdb54572b8b8c768
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 42.2MB
        • SHA256 af7d2cc32f457e1fbad2f5419b5edc476cd3dca9e793acdc63fcc4b68647c385
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 20.8MB
        • SHA256 73800802ec558523890331c0ff94beab5d400c51c46b5b5b6d2b70db4ac30216
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 18.8MB
        • SHA256 d4570a7490e3e3ab513169f207974606a618e349239a9f7e1172f087382aca48
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 24.8MB
        • SHA256 1e9c20cd4374ef50548d85d92b40228b25ffd48ed9c45aa31d6a13e71c760193
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 20.4MB
        • SHA256 ba1ef719d443a039679b4feea0c9d9d25d854b2cfcfface3f2e481cfa045ba6e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 22.2MB
        • SHA256 25dfc06a174222c90ab1b4667b224eb6aa4839c7540053377569ec9acbccfd66
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 21.0MB
        • SHA256 09384cb2184e00dbea74562eb01043f626da2218217a98b806afa61cb3974732
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 20.4MB
        • SHA256 5a8a433ec98a9c62da48a239039a0e93be9d83f72d975d7426ca5360bab3ec54
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 20.6MB
        • SHA256 84bead514f13de493038a6186230504cc4cbf4b2e000cca0ee6a58422134e679
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 21.8MB
        • SHA256 a20583c74f3bf7754129869e4b5c2f7bf2b217cd8fca9fd66c69db35edb4cb16
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 10.8MB
        • SHA256 79d0016da334fd022f6bf0b962a856badd8e06c0fde9640a836262f5f0afa4ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 18.7MB
        • SHA256 ffb86e888a505784f9bd886ddbfa99296e0d6447406cb4ded0c3ef56fc5002ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 18.7MB
        • SHA256 aec536ee38cd766d3ac2121132f67bd38d550f8c74657f4e630c83a5ad846d0d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 18.7MB
        • SHA256 87656593d996b17e82a55cb801d314f5b6dc21404b5974f802457dc23df70b49
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 18.8MB
        • SHA256 c1bbd357ad81f94f0b966336402542bf70a2fcee8415f474255d57f2d06cb98a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 18.7MB
        • SHA256 552f41153e16fa7e180b01aa61d1bedb19a7447c5844851b886ba94f38033c93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 18.7MB
        • SHA256 83e9b2c1a8b557c541ca78c2726779851281ea03686d8f46b700026b0b235fd1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 18.7MB
        • SHA256 d6de49c97c0a4e474d000cb5dbc778e95c11b38d604852b9facc46ead19a5033
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 19.0MB
        • SHA256 13bf07c2a9bcaccd63403d108fb4b47e9f46d1799d8cb713f1aeb2ed979e4407
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 18.7MB
        • SHA256 049a94aaa721e09a508f58eca2f5a658742c2db37c7e97f3b271533e426689e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 18.7MB
        • SHA256 162200f2180d07d8264ea99c1483e78295d0e59ba49da3c24725ca40d628c5d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 18.9MB
        • SHA256 0e4cd5f6ba67e47c06b9a427d49d94ee5a186fe2b1a3a000f060a80389660925
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 18.7MB
        • SHA256 a42e6a7bf453376e4b8bcdfa8f466ae52ba72a5f21450af86fa6799453a1ba9a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 18.7MB
        • SHA256 5a84bf0f3f6ca5280490dd8753ccf5713c646a0b2ffa8c73253406ca8514dd0b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 18.9MB
        • SHA256 664650b4d147b9bc8f7c691e3bfcdb7d7eaf3ed19c6bb0641f5a156c86378159
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 19.0MB
        • SHA256 2ed932b85a926246cae49df145227f5707e39b2182dac94ae03985ca4496d720
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 19.2MB
        • SHA256 ee34c93908099ad0b554c533d297166ffc1cf65e9c54a4fabf1db084791726bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 18.7MB
        • SHA256 fc57599a6b46c7fc90ad973f0608a3f472ac05ed22f0d554eb829fd2747a6831
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 18.7MB
        • SHA256 c527227d7f093d99f525d18f20b35ccffce726ec29715e1d5b1574f61c9fd1e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 18.7MB
        • SHA256 b90f9c621e7052a09c86ffee33347a194f7cde30d95f878eea685471b450f5d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 18.7MB
        • SHA256 92d5e55091211c70742b3d8b01b1062959bb2d5b9d1b0e8ed8b0427641618bf7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 18.7MB
        • SHA256 85d817d2016d68d4eb37a4c19b6d3be1ae47c1f9a3b8175a4aae91478de98ca5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 18.7MB
        • SHA256 1cbf4e5d99d180cfd8ae64e8074fc4b289ea390d1d62a96207ff69ad3e3de8cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 18.7MB
        • SHA256 6c8946369f67d0e9f3da10e796fb3e155a3f1d2725de6e70ad96d5fb45ddcebb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 18.7MB
        • SHA256 02df6729f5dc96681d78bbb64db211a093762fd47e20c67000e3d22c1939c5df
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 18.7MB
        • SHA256 8b5a8da9a63ed69f851f89322d023d673defab9d07262e813ffbd071470edee0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 18.7MB
        • SHA256 2201e7f17ad0aafd8fc77bb124d13aa16bfb59902c9cd0e52de781e484c6a66e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 18.7MB
        • SHA256 c3d6ebfe9cc975520a15eb6e0be93212d5f88b38f5cfeb53c32d9c190bc15a8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 18.7MB
        • SHA256 d034e4500771b36dece0f2a0db7f1efd548c8def7e723bec4d2baeb7af9e51fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 18.7MB
        • SHA256 95dc43f537528e99cd35313afa097bf0f0d6c85f84a197258886a418793f1f6f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 18.7MB
        • SHA256 47fd7b978e3ce5d8ed01d2709dfe5b461a3a2a5e04d034d03b6e621094eafae6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 18.7MB
        • SHA256 3856fab171dc9a6f3fe3d5298c77b302e071dc75b073ea6c93db5da625e076e4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 18.7MB
        • SHA256 eb2a473f498396da538d365594ca1e66f717fb8b89bc2cfd059b943d9561ff59
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 18.7MB
        • SHA256 13b1986e0c2bd511c17db3e2aa169f398f18393712656418a765529ecf3e4f26
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 18.7MB
        • SHA256 cfb0daa1fe9707d9789eba46c54ea9a4ef9e95205292621bfdf36603de1143d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 18.7MB
        • SHA256 357475e6e25bafe34cd6843ebcaa1d59c37ee4cb6cb5d936a66f7a324bede276
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 18.7MB
        • SHA256 c1e478b1ad0dfbe9b08dd5aaf1c6d0beb5890916df7e7068d52bf476d772df66
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 18.7MB
        • SHA256 183f877bffbe2a07c142129623563351d0d00f4fda7ead5564237cb37e3dc2f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 18.7MB
        • SHA256 514224d9302e70d0d448e31a75e7eca3b36daa77b7003a9387447de745ffdf8a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 18.7MB
        • SHA256 f7538ab82d699f2b732f66175c8e6d57d24b184a2a89b4cc98e95b5770b1fcc0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 18.7MB
        • SHA256 e40d1b095373ccdefb16c7248d5369fd2f5ae3f599d6a26496415eb34aa64967
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 18.9MB
        • SHA256 1e8471323ba34051709022dd2f7564cf6b2a9b78e589afb3ce51c5c4e44f8401
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 18.8MB
        • SHA256 bf313754dfcefdf31a7363b1e97ee582e77b9aefb44eb57143422e24269a9111
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 18.8MB
        • SHA256 d5baf17f33ee689bedd053a2621c2aa19b81f3ed7a4338618037dc1357ca08dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 18.8MB
        • SHA256 25ac596e9fa6ab433b153bd4eb87c09cdad90839ded2fc00dc1fbe6483dfa7c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/4684-0-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/4684-1-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/5944-2-0x0000000000400000-0x00000000004E4000-memory.dmp