Analysis

  • max time kernel
    148s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/10/2026, 23:58

General

  • Target
    2026-10-27_e686699fe46dc7c1c95b7b94ac63aa51_akira_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
  • Size 2.5MB
  • Sample261027-31ea5seg52
  • SHA256 f85972f5b8e29678d753c758f3fd67e5bfe977bbdaafdbb27bef374baf296fde
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e686699fe46dc7c1c95b7b94ac63aa51_akira_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e686699fe46dc7c1c95b7b94ac63aa51_akira_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1876
  • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e686699fe46dc7c1c95b7b94ac63aa51_akira_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-10-27_e686699fe46dc7c1c95b7b94ac63aa51_akira_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4588

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe

        • Path C:\Program Files\7-Zip\7z.exe
        • Size 3.1MB
        • SHA256 3c08cfc4d19b30ea66be21a5acaa33bc8fdfbb91c736b1c3a2bf01aba5e0a30d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zFM.exe

        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 6.0MB
        • SHA256 05b86b0e9219cf1eee763d2f8ae2da40d61a7e73a72ae29c7c386cc7b9ce38ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 5.7MB
        • SHA256 671da5233df0f5fe86622df1295dfa9987695feaa143c6af9866f0ead1715439
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 5.1MB
        • SHA256 2f9e3d6668f82f7a8e4eb1060334a29ed89b94c28334076b5a4af116ffee74e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 5.3MB
        • SHA256 eb7a8ec5ea2ff3d7c7987c9a223ea32e98ad6f8f0d41310175aa1eef93b388a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 5.1MB
        • SHA256 369285ba983c3f1afbae31a8b53d60b75390a0d1c2cfcd22c9e8169846277b98
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 9.1MB
        • SHA256 11ba1b8bd2a75486cb7741cc240a2bee9f1ff8bb6290c31e68eb94f1def9a99d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 5.4MB
        • SHA256 1c80c4ab9ef61cb704b0940965b2861d0093b2ab060790ef844fe2dba4c38d58
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 26.0MB
        • SHA256 cafdb454ed0a56232722e90aa9faec535031e341857bb3ff94be4d05543cea9a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 7.2MB
        • SHA256 9e0746ece0e8b1e252ac951970eb62be33044918e8d2b945051270ec9d9e68bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 5.1MB
        • SHA256 3f6e4a393aba60790d2dcc6010e8ca7024a68e7735ccf285fe84290834759d34
        • MD5 SHA1 SHA512 SSDEEP TLSH

        setup.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 11.1MB
        • SHA256 e4ee7824046421e7fa8b039868ce662b56befd525282c8aeb184171a87d7b449
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 6.8MB
        • SHA256 2f3c81aea24e02ac0953ef5a2043f765c584842e78d52316ae5d83def600a8d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 8.5MB
        • SHA256 7193d77317d700118680b21ac9bdfa394ec51a646d5a3b6532be9c77df51588a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 7.3MB
        • SHA256 6f1234da18bbc073f1d2cebcc4aa4355452a1d41b193744c96f93a56204f784d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 6.7MB
        • SHA256 ef39bb62722b80bc4c53a4e0b1ccd4838959751ecbf153121c09ce9a51e4c426
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 6.9MB
        • SHA256 8cbc7d37e9931afe2ec864c9e53e9cc62e8429b362d29fc24338fb8f5711e69b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 8.1MB
        • SHA256 48b2210d61a4a6ddce7bbc3544e575d825d1b3d0f3cc54ed28e8892e3b0146d4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 6.5MB
        • SHA256 33b31873c77245d8e64cf671f5454128b1b2c31d5275f400b1431a1af360f4a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 5.1MB
        • SHA256 57d3e9004feda739e1fb92ec08e05a1622c6e3ff734b1c0327d108acb50cd677
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 5.1MB
        • SHA256 78637969e9a6f7dc5c6784273a3a41db819c2d48650c0aaf17de6ed2ffcf82a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 5.1MB
        • SHA256 fd1d7c694efe4be0bdf6b1c9394b580930c875ae7a005b9efa60ba4c2987167b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 5.1MB
        • SHA256 2116f32f9e4eb3434a89eb7d42e44def3af008efde56e15ef5f2a6c236399890
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 5.1MB
        • SHA256 62de017ed1d4053540a2bee56685747c192e359b7a2621fa751e5ae818930781
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 5.1MB
        • SHA256 2842a5b242742aa80beb8c1f5166d46b01fdd50aabd8bab56dc3af828bc2bf81
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 5.1MB
        • SHA256 a70c3b812aae17fe4f7024543160b527b644af41a71064d73c72768ce6fc0a8f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 5.3MB
        • SHA256 10143aa83d59cfdb5156aa31b0c0746e3c3e7d1859318bb7feff2861a0b7ab10
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 5.1MB
        • SHA256 70f688547d8ac83456934805c67c98bfa0c15687d62493b9a5264e4d3f7da39d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 5.1MB
        • SHA256 db5830e29f288d287d152d76d7945b60ed2c1a44ffdca9967a3ae5d7137d14b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 5.2MB
        • SHA256 a4e85f7154be985b1d1a9ff4c004acd50dfc72c736539d89126ba7dd4d68b6e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 5.1MB
        • SHA256 6ac29031cf1feb5b74875020f223b06c7dc43b7f1bf36befdd6f168b3493fe0f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 5.1MB
        • SHA256 ba2e47a57c71be18694e9260f96229103b19d02f0c7df2c685a29a6c368d565c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 5.2MB
        • SHA256 cb485569d1a7a9991ef504e9cc696d7406d60c6ea09c7038c8b3a2915afe4087
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 5.3MB
        • SHA256 7a747a2ab8f2d90fc8a544b4877aee794c70c45b3068a39d86ef49c9065b1871
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 5.5MB
        • SHA256 2c71f66027de4c284b12bd8cf5adf67ffe18f5f7e1e02f8462971dc4fd8885dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 5.1MB
        • SHA256 b53be828f51420c3afec4c7731103e172d18583d05bcd448ee5f761db234f2c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 5.1MB
        • SHA256 4e123e47a3cc6e28d223a29204556a4df80bd963341704c741f923f0d7b18ea6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 5.1MB
        • SHA256 408b5c60cd56f916c4930d1a7bb9e21d40e1b0b7edbbe72d161a861ed6178253
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 5.1MB
        • SHA256 3dab60ef1fa99561134478fc12e88f9a5d56756afa85a07a230876f01021008f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 5.1MB
        • SHA256 f1a0e8eaa905de187c85a81fa52ef68b35f3ffb8b001a61bc5f6625e62dab4e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 5.1MB
        • SHA256 f5acd7440fefa92321cbbbf2cac055717eac41d79d659609407e896a0af5634b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 5.1MB
        • SHA256 4078582f2b51bb837fdace103e5db5aa07896b2e94b2c215d3a31550c9e86ee0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 5.1MB
        • SHA256 01d5f66760e49bae1b98c8d822985ae9f181558461dfa9782d2e37112f087772
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 5.1MB
        • SHA256 1364b6bef865ec2d5de77f8748b61029ae0e80d46da6d87e39e5a737cc3d4c88
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 5.1MB
        • SHA256 45668d2ced6f40d565054fb8c412f43696944fbd65c93a11bbf957a556e6016a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 5.1MB
        • SHA256 f559b0bc1cc46132fd52366ab71fbf1ad0327c94d0c7dffd18cf30e4073a7d74
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 5.1MB
        • SHA256 061998e2edf5c5500d301b371a7003d2c48ea3a85d407fc630ad938f26b2460e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 5.1MB
        • SHA256 7c42cb5b3f3a1088e6b6a7dba63e122ca23737637a4cc571c2827e0e9b4189e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 5.1MB
        • SHA256 c0dbab470185f98b35a6ec28fc32800f853ed7d904394f55d559308c2becd8df
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 5.1MB
        • SHA256 d5a15ad4c88f9d02e25d1af37a2587bf42dd47a50392cb97726e7d9c3e12f2ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 5.1MB
        • SHA256 60cf26f8d63e0ac35c50f6c13c83489a3ed5fe0aa20bf04a85577a56f8a2932c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 5.1MB
        • SHA256 0dae8b410cb47f87fbba908eb316f0dd31bb4c818e06028d31aa34e54010f378
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 5.1MB
        • SHA256 b7231d60eda31e49b3d451f768b4a9cc29df8d73d3e27bffe37bb9e51d007066
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 5.1MB
        • SHA256 a4a942ed235e859d8cd92311f77cc3aef33065e7c6795880319fa56b40cf15ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 5.1MB
        • SHA256 a338664f6f2516131f2082a4b82ae03ed2f4c06072fcd9b6a8a98da9d5789d36
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 5.1MB
        • SHA256 a8444dbf57e70c8342245f0cdfeeda746516768d70ae09e2392d11926c6de2a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 5.1MB
        • SHA256 9b61f0cd376bba330e5d3516fe5f40874315a6b1ba8205b0fa2c6afd9407c7b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 5.1MB
        • SHA256 f9cbf7c3c58ac1c18a752c30580eb26c4a973ca118153268a4ddd416e67d9f3d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 5.1MB
        • SHA256 760e13b7c6184c53e3afeed0e6a4a1fa6ecb26f58a1905bef0b8a1ddf951c155
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 5.2MB
        • SHA256 b96a7ecd8fc6f8480ffaf67319dc93ecba9b655dddc06098d5c1fbc43b67a85e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 5.1MB
        • SHA256 7164a44e05b1c68e0694a7b4ce252e4c97cacd7c4df52e4a2903de3283ba152b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 5.1MB
        • SHA256 6941a2cadaea7359cd70d36e31ca46339d5e1c55cdc1f08a62f6058e8ef5f0f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 5.1MB
        • SHA256 9098fcb4251ae716387f41f9a8db569c08f95f548b55dafe07a440e040b20e44
        • MD5 SHA1 SHA512 SSDEEP TLSH