Overview

overview

8

Static

static

3

2026-07-01...as.exe

windows10-2004-x64

8

2026-07-01...as.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/07/2026, 15:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_270803a3665ee57b371949b0736d59bc_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
  • Size 17.3MB
  • Sample260701-s17btabs7v
  • SHA256 3833918bb39d3c67428dacf4db549c93d0184d773911ec799c0947df31300fe6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_270803a3665ee57b371949b0736d59bc_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_270803a3665ee57b371949b0736d59bc_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4396
  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_270803a3665ee57b371949b0736d59bc_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-01_270803a3665ee57b371949b0736d59bc_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:556

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 34.6MB
        • SHA256 713754e736a3fc9d54e6625864fd44dca6653f26099199b6bceef2fb7fa752b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 35.5MB
        • SHA256 71a79df37bc2525cf95c1a8d4f388846564c82180e2dcdf2c6916f41e079447a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 35.3MB
        • SHA256 3489fcaa8140d253917702e61b79fd6333139039114d476ae91a227ed77518b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 34.6MB
        • SHA256 94f9248b7e960fbb3ceef84e0e060c92e8a738d861c08f35749f11a9f3a7ed11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 33.3MB
        • SHA256 a7982734bc2b75ba8731afa45cf5c92509583d5270a50573b1b86ad0fade6582
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 34.1MB
        • SHA256 30bd612c550e8fbd4a5e260146583d4aedc9ca34578da6260088efb9b48a3313
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 35.6MB
        • SHA256 8d7c4bbf4a582929a25cabbd4e65107364757ac1100b0e688037b1a034d62819
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 35.4MB
        • SHA256 09bc2afd4e2cc76c5f50085d8bd48deac8ec2dd186ce47656bc5d911ba6896c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 33.6MB
        • SHA256 8bd37b54eacd2b11d4265a34a04cf7ce63a60d37d7acb7dd710f77d743284842
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 33.0MB
        • SHA256 75b9a03a193bde4d22588bb7adb554df9b88fe99c92cb8f5a5c10b5ff9a972d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 34.1MB
        • SHA256 17c3a3b2bf9ba936db29d578bfda7412af3e025f58402815507cf9705540f65c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 34.6MB
        • SHA256 fa9f00566d809b3bae5ad3bdbb97af5ccdc27da01c2ec15ef6b0030d21c6ccdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 33.6MB
        • SHA256 53deb91f0be79bd9a5fcf9b3139ed868734628a64487e6600dd4e370ca975cf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 128KB
        • SHA256 e52488a8a3c5c15a2f928eb2127c84d20ca0143b2598bd3c627a271a6a7a3d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 32.1MB
        • SHA256 08a43c84efd9d877c037791b4b52db6fd3b5581b3bf14550b33d3d9f9533f294
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 33.7MB
        • SHA256 1d2e4f89cadc4f95ae34e8f71fd423aa61467066c8f8b07b1210d257740ff675
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 32.4MB
        • SHA256 f5cff16e96d4233b3dfb42266e2520b55267dd33cf3e352166bdf956e7208e91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 32.6MB
        • SHA256 73711425be05b678aef55af5119edca9b16f6e6dcd09334b848990cc7a61ce0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 32.6MB
        • SHA256 c116df542ad64221c16db54b91c2647bec9b6b3e38d33a60b8857f69d4f876af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 64KB
        • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 32.1MB
        • SHA256 7ff90f36c20332971dad820330e9efa0ddb6d6255f62037c638d1bd48dda58a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 32.6MB
        • SHA256 230f1bcfa498088f44e058a5a882eaaeb4b67c8a1431b584da20295a5481f440
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 32.6MB
        • SHA256 ca8bf692e53c8448f2ab0ae87995034fcec76e08c52fea9040ca00729e17bba1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 33.2MB
        • SHA256 8f846b80524ebef015f9b227e8b140a197958552052c5b80010175305c565ea0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.8MB
        • SHA256 8068ba7c13e7660c4ef50a5028c9fcbb7490934f2bca8b16a63fd254c19cf276
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.6MB
        • SHA256 ce535385a0104ee0121604d9a777fae6b2f6e47462315d4e6a2ef206797506c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 31.1MB
        • SHA256 060b2a0393480ff7d99c853467fb81673d7a2fa0c5eb12eb160924acab5adcb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 30.9MB
        • SHA256 f7bbf7b34ced0559f1480978fd7ca8ed3fc0ff46f60623ba704620f802852377
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 32.6MB
        • SHA256 ab5782047f07f0e45209688c7ef2377d52149e79cbee0d21ebd4bbb91d9892e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 30.7MB
        • SHA256 61b46a1ec424bd90cf7edb9c983de1a97740183ada089d70294c74694442713d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 32.6MB
        • SHA256 62bbdf62c6f82c30455909ec8b8a1190a24c156dda84c614d3860bcd870800b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 31.6MB
        • SHA256 c35aabfb2d1dfc6a337f85bc8dc49558b59d30f197f8b46135e9d668ac7e43b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 31.6MB
        • SHA256 4e76cd0391055efaaef7ac24f01ade7db4ac55f04b450b5d13ceabd7b23c5bea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 33.1MB
        • SHA256 11110579e9c3682b70c035a5ce9f580f722b18107ce9138364056c6c75aecaf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 32.4MB
        • SHA256 241cd61ff5fb0e71e4e2406af73a653dec4606449a900c5ff1e5314322e9135e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 32.6MB
        • SHA256 18ad02a94b49f92930c9aa9735608c175ae5d3a416a5903b3cd25fba8995189d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 32.1MB
        • SHA256 bbb6627798f0ecd54b87b08888fa29de392176b56b8753401bdcde2a733e50dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 31.1MB
        • SHA256 4a2ab14307fe144a050c5fa4c1cea77be217db23f3606c87bf3a97db5c84486e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 30.0MB
        • SHA256 1f60548b2542e1c04b952c560a7ca3f900ee9c8f3c5fba34a20ab4f9f4d6aaea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.6MB
        • SHA256 b157dc2cbe4a86c550c56edf27202ae36d718bd022c07e38a35820f44a3735c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 29.3MB
        • SHA256 465797bb82382cf0296f1084206f9b537c72602880d4c74a2a8f8316ad4adcad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 31.4MB
        • SHA256 9f14816d49b8e2cc7ebbf0944c5678d5f8ce01a7cd89d455323d19a18b539604
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.9MB
        • SHA256 256ba465145c7a8faed9fd3f2c17be1a404a6855cea9b745fee0b26405b6cbc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.6MB
        • SHA256 46edb80f5d27fa89fd09d45c8c4442f2ba9b72555efc99d42fab04f6a5e99221
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 32.1MB
        • SHA256 b10a4773bf83dc18c7dd2b87a4fb0624cdb89a1010114faaf88b2a317d3b697b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 33.1MB
        • SHA256 9e489c51a093fbd6f73845f4a39a70ec1a741e94c330d013add2b3e2dff8e995
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 34.1MB
        • SHA256 3eb816e9e64d92e8fac8bd684dbebc2518939b95f636bd665f18901ea3f75c2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 34.6MB
        • SHA256 80898197849778febb15421a644480b2e53b1ebe4ecfbc6c9ce6dc1ea2265c00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 32.1MB
        • SHA256 3b33bbc8279d329228bb28f0cc80843845e14a5c0c451cefa1582182a326dd35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 17.3MB
        • SHA256 3833918bb39d3c67428dacf4db549c93d0184d773911ec799c0947df31300fe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download