Overview

overview

8

Static

static

3

2026-08-23...ar.exe

windows10-2004-x64

8

2026-08-23...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/08/2026, 23:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-23_972580b69e113e5f2a156f18d6b8eb6e_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 6.6MB
  • Sample260825-28c8dabb57
  • SHA256 e85bc06dbe9e3c00e1868d4eb907206dd0d61c0ba2301b12c52b5b909c200c5b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-23_972580b69e113e5f2a156f18d6b8eb6e_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_972580b69e113e5f2a156f18d6b8eb6e_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5576
  • C:\Users\Admin\AppData\Local\Temp\2026-08-23_972580b69e113e5f2a156f18d6b8eb6e_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-23_972580b69e113e5f2a156f18d6b8eb6e_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2224

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.7MB
        • SHA256 183970f93a7c68280d49cbb698a19c11e328c1bc23b224ee54dde8f25c88c599
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 13.6MB
        • SHA256 fbcc7f10c60fb8857a7941ea7521849dc7efec38478cca4b8c777cafd5357d5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 13.3MB
        • SHA256 41afb691b9367c2f2aaf8c9b0a7b5641a2d2fd02268387cf98f4528959440dc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 17.4MB
        • SHA256 541c897f7355eb0b8c1ef52f3cf5a551affe3113b5770a5c6b10bbc829282e76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 13.6MB
        • SHA256 0391d5ad7ad9a149d267247bccc8c67904a3c49681d19d5c0dbb1a4c7fc91ee4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 36.8MB
        • SHA256 14399509d5d3958c4bd74c2d2a39d93e26ee9dc5de9a9d517bfe3f3737239776
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 8.8MB
        • SHA256 36143ad7c4179563eb46ea86b0ff304a1d48482bb107ad558c7e3149fd39e53e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 13.4MB
        • SHA256 fe53a9946f132499c460b21a5bc5e17bc43ba9a1cddf6200295b2205e4f4c7fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 19.3MB
        • SHA256 1eb279d4adb639cdc4be11723833b3423de3b9d677c956668ec1f6313d7ce6a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 15.0MB
        • SHA256 51197f8a89e91ab9587fe16746aa16dc1e886d4ad8d8c0889f43029e82425a5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 16.7MB
        • SHA256 70a7a47721ae6f806de9b14fecdc14ef6792f55d6b70c7169939574035fe06ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 15.6MB
        • SHA256 7b01b396bd45baa8038b557798e7cf861579105b59e0f407496985a7e507841a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 14.9MB
        • SHA256 0d681cad379d7e076437408532b6eb0c4730c659c30e0e05d4b68f048c03c824
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 15.1MB
        • SHA256 fe90f82d94102f1cb33cf12d52b3aba1ece819a54c77d1b6e42ed689483c9177
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 16.4MB
        • SHA256 5619470df84313b703702cdf54110ccaa3de48c0cb0bc45a51dcbe4d3f01b8c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 14.7MB
        • SHA256 3edb293a911aed1a4e385e0cd2cc026c8720a0581dce7f3f6bd5b3db5f8469ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 13.3MB
        • SHA256 49f07b93ef3d9fed321f7e27265a95a93dff4f4630b355a1cd378f6553dc8ad2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 13.3MB
        • SHA256 95b9a8974df21b301e51c319088c5816aab571e90f0e91f52a8c417f81700568
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 13.3MB
        • SHA256 4529242416dbd743d86d30e62a4814ab13804dcd4d1f7c060983208fdb80f6e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 13.3MB
        • SHA256 7c3173c27f13630a8836dcdf80f7d35ad201665156a14a36b33de81edd7f03f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 13.3MB
        • SHA256 7554c094a12695106d686aebb2097b5d2ad3ac77b76ab28f4bc1321f956ec8b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 13.3MB
        • SHA256 6e7fe6c789dd08eac045f9e5d9aa912e96026c0c7b9d29c5ac059008e0a5ec2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 13.3MB
        • SHA256 3978b482e8db754cdab707349e2b14c68bbbd8229dfcf7f3e4b2b01c766b0ce9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 13.6MB
        • SHA256 b8309706ad75562b43b9e00e23b6bfdf84408f06caf724ace32b097181121aeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 13.3MB
        • SHA256 20bf67b0c201a9770e21b62403a195ba49fffe235dc039fc43cd43e2816c002e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 13.3MB
        • SHA256 171208ad9de54f8bc1d69a9935c898030e7059a8f8b9ba409a053589e27f2c49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 13.4MB
        • SHA256 824821aea8d7cdde20b5ea2ed9664aca5e990dab5e09188a3513ef26156f855e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 13.3MB
        • SHA256 bd1c53d9214ddabe16a2a0506d853222972a72b5f57c7e3e09830ff79ffe2dc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 6.7MB
        • SHA256 cc1ce8b7ae649fb9a8936f904e0a1de350c150238554fc54f3ab5010db2f81bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 13.6MB
        • SHA256 07fdb9024c99b627203b97f8ad1a222f98ee79c5183de651a05ef7235f1436c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 13.7MB
        • SHA256 97604d09d7ed098f5ac710f8ee4fcb5fb6be7505177c2da72d7bba05b41eb789
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 13.3MB
        • SHA256 f3f6d08d404e43dfb42b0e516a8fe42391df15e810a9debdc39ec95e12d43575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 13.3MB
        • SHA256 ad07aee3437a4e9c57c1c9d18d9ca0f298f551543f64ab7f75aec7a97a10768d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 13.3MB
        • SHA256 2369fb59615f1203bda619dc54f4abff0a4fb30a15ccf9969d67dece8a39ab65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 13.3MB
        • SHA256 67a3ec7cd67c7a767a2e4d621e6e913d279cb3c6885d37a2817aa94ef6ca852c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 13.3MB
        • SHA256 b47251953c962d9e87db5f62200ac0742f3c70f1f0ef6092dd95d5163ceb55cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 13.3MB
        • SHA256 02653e38fd76a3efea64e7cce9e8837a83348853bbbfacf49167d9dc122d6c8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 13.3MB
        • SHA256 00d7958747558e0d330f1c6e3b192289382e2d0b737a4ed5710dc16ac699cd31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 13.3MB
        • SHA256 f459b8ffe884bc24fa8d21f81db6be12deef55d00dcc37319270bf2ebee38422
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 13.3MB
        • SHA256 2199e6f1bfe4b375f8dc622c38d43770dd9997c0d03ba0c565bc64cf6a64d972
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 13.3MB
        • SHA256 a37497f18756810076a1b12273533d88f5338c14360dfac455706082def54f9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 13.3MB
        • SHA256 45526122f75cdd423983acd3900481e6563574439bb7ebebf2a21d28438b1486
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 13.3MB
        • SHA256 15ce338ad280e50d84750106735b24227aa879d07c251343e114b4f11de0e28f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 13.3MB
        • SHA256 df12c73fadc4d404cded7031308c79b2114c36b17051ff05452e0e2601dd2de8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 13.3MB
        • SHA256 44f2aad5e215b4ed11ee7fa59763d3f3227d6dac13b6e85f57718e78c657f33a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 13.3MB
        • SHA256 d266eaa181facac46a471d610ee1fd24514531b1f2ce772b8335336c99a8bef2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 13.3MB
        • SHA256 3e5fed577c08d941219d567792baf10eafc80ea92c874afa743b56f1544ed562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 13.3MB
        • SHA256 f2497187cb9e8b793c1c9eeeac42f9885c9c03f72c2dd64cc827a09fa5848d3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 13.3MB
        • SHA256 55042a2b146dc03fe262cf20cc41bd027c5ad4a805b8ebcfaf8b218f1f6ca39d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 13.3MB
        • SHA256 422b7ebc05a541b77da5cc799bc270e73a42a1943bafe066fe306dd54709717d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 13.3MB
        • SHA256 dc578241d17820379755bda7472ccedac56a924ebf7c1511bebc1f0297387d4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 13.3MB
        • SHA256 e83ddd8ec31df32e02f0799fef1ce45929f7175eefa8c8d498f73a3590d6ce60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 13.3MB
        • SHA256 215f0b122e684159bcd32362773673a970f30352ed02d440a5a091e1976bf0d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 13.3MB
        • SHA256 35323b925b9cc9b1b990cb846b7f5e4354ca6f458f47f6d4edd962b5278cbdbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 13.3MB
        • SHA256 317b1782107d6dfa0d55d699ab9aa3b77040f501447c2eaa0bee21023b903e48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 13.3MB
        • SHA256 52db22406164bce18143cde9e3b6103763d05dfa34ad323dedde1c38d7ca6c61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 13.3MB
        • SHA256 f245b47305f53e27dc52f31f9199ca71e8f465b2258b05cccbd62a5ce9770b53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 13.4MB
        • SHA256 672992355070e61fcc5aa691bc7b94441fcc4c7e30237fed19c90158045cd1b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 13.3MB
        • SHA256 a97db12595c8aa8cf4c8750b1fe65c9f049cca43f992cd775eb7c98701b9c145
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 13.3MB
        • SHA256 301dffd86e6991ccfc813e79c8a2428b17806b0d7e0f787e2d3cd857ba7e3c27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 13.3MB
        • SHA256 9846afffb3fc8ba2459a6a7c1aae715c3b8ede8cb21536da9ad0714b4de8142c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2224-60-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5576-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5576-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download