Overview

overview

8

Static

static

3

2026-09-07...ar.exe

windows10-2004-x64

8

2026-09-07...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/09/2026, 05:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-07_d365c6bc67f3826e3f40cd4664f9ea80_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 8.0MB
  • Sample260908-fpaggssbpd
  • SHA256 21b59631486875ca3851d65367b37dc4f2eda078ecbce385d743be3488ef9dbb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-07_d365c6bc67f3826e3f40cd4664f9ea80_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-07_d365c6bc67f3826e3f40cd4664f9ea80_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4676
  • C:\Users\Admin\AppData\Local\Temp\2026-09-07_d365c6bc67f3826e3f40cd4664f9ea80_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-09-07_d365c6bc67f3826e3f40cd4664f9ea80_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2972

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.7MB
        • SHA256 0861590b8e129de7fd2b82ee1d4412994a56d0b3c75fd181e2df58abde4685bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 16.3MB
        • SHA256 7c8e1b73e2bb777a81d87e2b4262b344ca9d341ffdb7f83666e4a672c22d0926
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 16.1MB
        • SHA256 019ddf7c9af0b29d44bca1b95aeb9cddd960106524256be90bf136c8c20bbbc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 20.1MB
        • SHA256 ab292c816c4d24f1b4fcaaa8e3f3cf829e25a080a14fccf12220876e8615ecf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 16.4MB
        • SHA256 7b58f0878df0f9693d0052d1f35aaac261b0e8340aea72926e83042ee2656cfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 31.5MB
        • SHA256 5c0dada56b742e6c21b5946b4acf69ce420f9d071dc512fb58267482ff0cd885
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 18.2MB
        • SHA256 ada50ab07e7ade7b3e5fd7963106a29dff27e27ee6ec1d3a8967f634f9968ba1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 16.1MB
        • SHA256 5ea0872393a2fd520656a469a90cce76fb48d8ecbdeade6895a0d10dc47793c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 22.1MB
        • SHA256 8c85dabd17193d04c550501572ad1e077a5addc6958862bcc1e260ebe7bbdf4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 128KB
        • SHA256 43487443e34438846ba103b7924eff4a32e10c362356ffe679e3f7f007a74316
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 19.5MB
        • SHA256 615fa9a77d1e6f5dc7cf4ce2771adc058dbcb59071c117a9eec250cb36ac383c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 17.7MB
        • SHA256 55dd4d196375c07ca5585a31b4645bc026653f9a6c8f84f84b416645eab07211
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 17.9MB
        • SHA256 3df389c3e70d7f78be1eacb82d71404675b63f8ebb078b836f3120e8e546e2a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 19.1MB
        • SHA256 90b503c804d9b574b7976f65d5abef075701a645170845839f92f5043068aae0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 17.5MB
        • SHA256 20cc8f697c3096d72e014730d2af0d72a2e1e5ecc6d3a434556827d1767a42a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 16.1MB
        • SHA256 efe65605c5781a1dca7970fa4713a0026612ca72c24c374b39746957b74a9548
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 16.1MB
        • SHA256 8b2f8e0b2753cb30da7c6cde6f311b75c88b118fba281be5570044d08524d393
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 16.1MB
        • SHA256 f5419b64c7a34d15bd967be807eb85e34a0593b2e9401bd4c2e3417b7fa31428
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 16.1MB
        • SHA256 7026db77b2b9d376eb1edba418176d1cd5d12c3a2e5b7e540246a837b4a77c71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 16.1MB
        • SHA256 7a43421889997b5e00b42c40d10ca178b76c013826b58684bee3ef13d43db830
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 16.1MB
        • SHA256 b7c0187851876595c17cdad3683e19628798666e52c2051cb0e3f49cb71a6db4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 16.1MB
        • SHA256 f45950cd947c32f2cfad9227456eee49fa247f2c0137d3db9ba316a56603a1b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 16.3MB
        • SHA256 acc3e6d61eb345693d0c8eaf65635a58d402b7295316b0695bffff1c538aaefa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 16.1MB
        • SHA256 d2ffee957c2bb01d96ff908b84f7b8a5e3d4854587fbb7bdf9d59cc2fc91d7ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 16.1MB
        • SHA256 40f5c3d9e35f097b00864ea6cf48332fcd76458ce2e14f44cf7d0b338ad6b5d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 16.2MB
        • SHA256 15f8555d92492aa2d02fb1e1f1e62a4618b0c1c8c1ae6091abffc8dc999323ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 16.1MB
        • SHA256 98a14c3072d32fd7c7cb180631a4c099fbe4043f41a0fcc991c87f31aed81ad2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 16.1MB
        • SHA256 b0787cb3cbad47249f8d93a535d6ac25517cefbb54676d40c8ad297c224d3f31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 16.2MB
        • SHA256 632f22878a4dbfa7c146e95deb963c6f43314817d9bb893c9f1cbd26ed86a994
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 16.3MB
        • SHA256 c8487c084fe5f21ca48bc09a009a131e1525184b09618ad86a916b6bb1f4a186
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 16.5MB
        • SHA256 173d1d15dd68b4fc1d877aeab61ce2d5c407bf4fd79a7cb91a2bca772966faf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 16.1MB
        • SHA256 1b8dd20275b8ea2d766243a867fd2be072d615f67cedffc9df78479f53b5b95a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 16.1MB
        • SHA256 e12e6f63128948761f79d5eb8fbca59f89ae2d725c2aeccdc45b90a8125527a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 16.1MB
        • SHA256 b4cee727f9a70bc038e377398afa6b9a8e3f13354aea4dfe5efbb6a414d5720b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 16.1MB
        • SHA256 f4fb05f13294a4ce3d49ea78b6f4c473bc472eb567984337a4754dca1bee4d73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 16.1MB
        • SHA256 33840f8e9998e43451bfd548ab92ff85a74f0800ee85f8665dc09cc22e631b0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 16.1MB
        • SHA256 5f4a6c0f7f34bf155a30352342f23a11f2d4c58a865fd7b51c5be9eb4c7114b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 16.1MB
        • SHA256 246f0d7a367a4c0963e17576d54c36419a0267b8cf70a3ecebc921c8a5bcf100
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 16.1MB
        • SHA256 1cc69c6909eea677d2d5e9c7f8db89c59b9f2bbf50e0fbd6aa8efc38f8911a82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 16.1MB
        • SHA256 371bdcd28dd8313f718c985cccd95b281e5d3f36689acf6420a0b0079de08bfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 16.1MB
        • SHA256 3cc75bd4d73cc64de7a20a80469d4f86850ccc8e6c8f0e02d36261b8eac2d1d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 16.1MB
        • SHA256 d1f8e271a1cbebb362243afbacc14005d8ef5b83cd5338d9b984e86dd6da9f57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 16.1MB
        • SHA256 df8c6429130beaae7ff027f2e43e7c877ddadc6cd409ab4908b6bf72b85f632b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 16.1MB
        • SHA256 4a0ae964a8437302b11c7d177c75723c00d3c61f90ca02e963a38e2e4df6912e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 16.1MB
        • SHA256 6107bbc33ee761b172bb772cbef3dafc7488ccc32ec58b8f041a2a4a080ba786
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 16.1MB
        • SHA256 ce7ed6179843c36f89f2235bb231398b022ab39800077532a797eab27b279d15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 16.1MB
        • SHA256 24539232523da2e4240ad4774c3e7f5dfaa8fcfa33827d9178e4bce5f335caff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 16.1MB
        • SHA256 91168d0ac41e16f6420e526e960f0626cb51bd0aaf90963363e3aabec5563bf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 16.1MB
        • SHA256 edcf74cf12104982cfcae6be380ae0c6c493334d7169dc6feae75a942e75b3d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 16.1MB
        • SHA256 4177a07f761c157586556094acf89a0bc9e35d669b1f136a53846bb908975396
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 16.1MB
        • SHA256 59e80284c9b77d8d13d192debdc1619593009af7b36219743feb301ad67ee5de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 16.1MB
        • SHA256 ce8a1f43cbcd422be5516430b6ba4f0ed3ae6f154042c704c26787f730e6cce9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 16.1MB
        • SHA256 9494bc62d8f378b55659a699aba65c878b82219507ac4f2ca8042ea8e674753a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 16.1MB
        • SHA256 55ee461ac3269e8039718c8ab676193d68f647eff063614f31e7c1549aaaba7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 16.1MB
        • SHA256 5ba383c54108a068ae39cceb94e1dfe6b6158484a5302cb1f400c18d2c32bd46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 16.1MB
        • SHA256 e3fc6793e1f8ada63875cb8d8a7528c097c0d19e3d45f74e1586ec51be067b5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 16.1MB
        • SHA256 604ccb7473ecb83335ca935c41db52face783dc35fec413a63ef6830c111631e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 16.1MB
        • SHA256 509d3ee0f19295c9bda8a1a830e8cf2b9e09f7445e6adaed4f2db3ae1d29a3f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 16.2MB
        • SHA256 3842c5f535751c6e836627b238652c167ecacaba5f51a35f7a7abe70ea40ea5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 16.1MB
        • SHA256 a0eb1b819febd5f0f1c7c49a3e4f959f0e55142e3633ca70e0360618c4a737c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 16.1MB
        • SHA256 9c531eedd0580e6c9838ad1c698abfa2a528b1989a672e7bdfa55f5acf50edfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 16.1MB
        • SHA256 a906409dbb6cea697e6c2b589b39e3c1df208f7e86bc7c84c95532883f42da01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download