Overview

overview

8

Static

static

3

2026-08-23...ar.exe

windows10-2004-x64

8

2026-08-23...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    93s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/08/2026, 09:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-23_6f350d77b6989a5db308c83b0c6221da_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 22.0MB
  • Sample260824-k74khavfla
  • SHA256 35d10d9390c3ccd3175bb84660359d71d21b8f045daab4a018a62d0aa70221b2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-23_6f350d77b6989a5db308c83b0c6221da_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_6f350d77b6989a5db308c83b0c6221da_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2096
  • C:\Users\Admin\AppData\Local\Temp\2026-08-23_6f350d77b6989a5db308c83b0c6221da_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-23_6f350d77b6989a5db308c83b0c6221da_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2200

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 44.5MB
        • SHA256 53e0777f0d74e932406fab2927b9e6985bb9d374f37ac2672ef684b58e687b66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 44.9MB
        • SHA256 536b16def15677976ae97ac0fc493882d77818c40e03787de3d4b7b78498b865
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 44.7MB
        • SHA256 af0d0365175448b9ad47c54d38b433a585d6dc8b18214ceb8cffed8e5812e807
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 44.0MB
        • SHA256 7fa784091c77e8760f7e827f702b958451c2985e896ae17c0d70828029d82ec8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 44.1MB
        • SHA256 49cf8fb690ca0891df283b554f1933e36c786ef85d0a50d49471bac2476c9054
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 44.4MB
        • SHA256 9996cae84a6e58e069bf944872fb61490c3e7aa2ed17c1018dd21897ce3a67b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 67.5MB
        • SHA256 a770d6805c0d40f186cd6196410905bf6865d57da73d372d8334dc5138dd76d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 46.1MB
        • SHA256 dc2b8668379fe4d7acb89881dceec8f03ec8ab43be46800a2b2cccd5a3e10a47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 44.1MB
        • SHA256 679ad70fceb4412e4a94221a1b4a884da98396a2588b6a2fb352ecc2cf85e383
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 50.1MB
        • SHA256 7bec1824c7792296cae7fb6841b5df382ba28a8f679124febeb7712490752102
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 45.7MB
        • SHA256 d38a17b8afa5df11a13b39a11e8c02cd99a6e3d56f7e7b4c5244c756ebf6f7ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 47.5MB
        • SHA256 74c83c7ff5229caa8d801eb07fe22085f49f89d56048e78e5e50d1193219e5b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 45.6MB
        • SHA256 b2f88523f192263a6b82442f4de6d2c25e39cd62ebdb998fb55ffca049181c0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 45.9MB
        • SHA256 6a49f160f00c053c648727904a0731c7ebcd40f635aa1786364a0ec7454c7521
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 45.4MB
        • SHA256 d9c9304c0f5c2c4bbc3bc15fe4abea6ee91520b8afc71ce78a90f8b9a7d2c0c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 44.0MB
        • SHA256 e0a8a0e57e4cb1a84ec0f33915e4f7af72917718077c350f0202d197814907c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 44.1MB
        • SHA256 338ff350a4461c6a153c432679fc61138fd4ace5cf961f44680aca131559f640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 44.0MB
        • SHA256 7feb4895f47617be198a28c3640d055601a1c5f225c5d0838aefc4ac87028a8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 43.2MB
        • SHA256 55f6c002848080246d065792d7db44a5538251a2fd2ea3291601d6ea4276f647
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 42.6MB
        • SHA256 17730d9d3bc86b9c257df00b0e24529a8409bb421bae46a80a4faf92eeeb588c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 40.8MB
        • SHA256 3e23d6cbf72719ee023c833a2c28c06eacfb1570b666ec65d62d90516a028447
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 39.4MB
        • SHA256 6b705d00bf37ce614ba3f03953b1168e9d480eb5a700f6edf01c2d1365b5f2b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 35.8MB
        • SHA256 98b233c2449212dac7d81685f7d24f2805db3add95db942b2bebf57c368a5bd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 26.8MB
        • SHA256 0811d43cc2d81cd80167eead77e59facc7e109cf5c0b113e1f480ddbb482cecc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 26.1MB
        • SHA256 28d75a0fdfa3d6e4a5012987fd5367637a498a1f960e177804760c95c1729742
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 25.7MB
        • SHA256 6f46e9b5b9b3b0db379cfd63dab9878887466bb7d5b49ae03bd292bb7d5ad2d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 24.7MB
        • SHA256 455eb9c4ede084ff2068c50beed5191a1c66791593bf8f987ae154a6439d281b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 25.6MB
        • SHA256 fe52021e972553b4b61f5276021b713ca3951dbd61de324860503105054af58e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 25.4MB
        • SHA256 c792f5aafa54797b1aabe8843e492b4d00ece58010bdf582a328b06a8a87a9ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 25.4MB
        • SHA256 030ade8696371ed2848cd97413a7a57dcb854e7fe362b0871806d8af4d8315c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 25.2MB
        • SHA256 e23ac8384a9692bf93caddd672e8362473355318c54f4fc40f35b9bef3b1b95c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 25.2MB
        • SHA256 09079fe2f41e282732965ece882e5868cb20f80df370004dee6adc342a134f25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 24.8MB
        • SHA256 de19c2568fe49aea73eb3de9fc228bfa64597c3124e5c18f25dc044dd015b79c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 24.6MB
        • SHA256 1a075816a5b4c1bcde8aec5301728ca3d6bd2fce81394e67371a7e760c491159
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 24.8MB
        • SHA256 e8f4333678cfb07b47e926ad0f5d7c1111d9ea9b92c22465163ae97c5556c5ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 24.5MB
        • SHA256 1f4530aa6db43960c90ec7d1b945087214866f327ac8cd30dd79fe8154ebedc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 24.4MB
        • SHA256 a9a5e25f6a8b6167f68fafd9bb6ef388d8926d30363732d05503f1b62dbc4f86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 24.2MB
        • SHA256 eab11bd9e5b7dd7cf5f6b6b178085df0fffac2bca6f1bb6665877d084ed107c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.1MB
        • SHA256 8f11b61bbc25fb74b4483b4b21778079d320d70c867caecb4ec0ca4d2d06fd88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 23.9MB
        • SHA256 4d6b09f962e4a49efe861b4863952ed4833bddb2c76c9d69022ed666418bfa5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 23.8MB
        • SHA256 88228ef238d95d56c3030148265f58eee5a2294a8a20c9581d516a55c799e468
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 23.7MB
        • SHA256 58f9a3f42653804d23a38d99e6e7e324195e921e7c38e73056a1a8a6e58799bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 23.9MB
        • SHA256 c407cc0aa9aa0920f427ee914a802ad1152761ee9cb1fe9d968656254211c31f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 44.1MB
        • SHA256 157cadde0f70c9c505720a4ef24ee8e327096f3420c3da4fc9c4f0bdda78ac17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 44.1MB
        • SHA256 b5c834a1d68645806abed44a5f2624ef3c6d59ff0cce6a3f718cba6b2b67ce8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 44.1MB
        • SHA256 4790bd4b34e258bb167cc4dad65fdd8ca37a34d874715d9e97ed1076d1e131e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 44.1MB
        • SHA256 1d9ffce0cb4d2ca120e3f92b121add195418381b533430df54ab5f7d55a390dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 22.0MB
        • SHA256 35d10d9390c3ccd3175bb84660359d71d21b8f045daab4a018a62d0aa70221b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2096-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2096-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2200-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download