Overview

overview

8

Static

static

3

2026-07-01...as.exe

windows10-2004-x64

8

2026-07-01...as.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 15:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_26b9c42a362555461e1924a4c9e4aece_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
  • Size 13.2MB
  • Sample260701-s2barsht5q
  • SHA256 cc73668659c6dec4b57a53c9351c2a8a30fe79b352c27442beca671caecda0bf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_26b9c42a362555461e1924a4c9e4aece_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_26b9c42a362555461e1924a4c9e4aece_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5280
  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_26b9c42a362555461e1924a4c9e4aece_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-01_26b9c42a362555461e1924a4c9e4aece_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1712

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 13.9MB
        • SHA256 3e8a47278e263da6f79c1a90fd68881270105f48da08e0651dca535f2d18cf66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 13.2MB
        • SHA256 cc73668659c6dec4b57a53c9351c2a8a30fe79b352c27442beca671caecda0bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 26.8MB
        • SHA256 5ec7782fc494c12d3d0e7afee5791d15dc33ed791d36516fc4122d4559a18995
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 26.5MB
        • SHA256 93fda043997b58f1ac985415bfcd8f674ddc08d4bf7214dfe0665c8bda12e3af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 30.6MB
        • SHA256 ce435bf4b5c3645a5b89dbd9220c3dce5ec54ac1ecc42dd897a093d8ec1b356a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 26.8MB
        • SHA256 7920fe27071929b26143aff5a4dc6769b395aabddb532f91d3f77f1d98be2734
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 50.0MB
        • SHA256 1d7f475f14b9422e4f527c93d75394c7778d6dc198eebeb1d1aa8bf73c572968
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 28.6MB
        • SHA256 4a6d7592f3a10b5bbac8fe2232cd802b3da2b6ccb4e7e359890e14358a7a4f6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 26.6MB
        • SHA256 d81901fa091283457fc3b82c67f54ee0c4f3d35d5f6f1453aa3ed32a5dfa6028
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 32.5MB
        • SHA256 5476d81c970f6e3c7fd00b425bc76c43238e8998a170ef9e05effa0d2b2b2760
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 28.2MB
        • SHA256 6563139b9c11a3149a486ebe68919908b9b799f68ef7961697ea2caeffb4cfc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 28.8MB
        • SHA256 abcce00917ed2216aba332828994a31d31b3fc45fcad7e9ea3e2afde31d9ce7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 28.1MB
        • SHA256 d42ca74ab8dadcff4d3cd023609aec80254ccd9bc44c62e1a789575245609275
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 28.3MB
        • SHA256 3c934ae69c675808cb8fb40d6e9dade1e0fe8858108423093058f642e24f5c7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 29.6MB
        • SHA256 ef0b827d2c583bcbd04cee181cc9efed385737687feff66c14e924860d83a49f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 27.9MB
        • SHA256 281e1cce101e4121a5df7b6a88ba6ac1f5e724ec5ee056e7f271d3bc08b8c15b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 26.5MB
        • SHA256 369896ddc61fe5d533e95d2998711867cf0f5f3a8c5d1594aa041ed096a1b0f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 26.5MB
        • SHA256 828ec1f3642cb55aa5833375152917530dce61b927ec624ec455d4d0eeec1164
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 26.5MB
        • SHA256 8666da90526c326078e2ec0bf75961cd255ecb6f4be68cc9e256a5f50bde4edb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 26.5MB
        • SHA256 0842d05a568c5db3f7038c73cae65d4a8201038b69f563fe8ea15120eda4d28b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 26.5MB
        • SHA256 b2f31fbdb0fa6bc4992a633df011effe55a049a480df4e779b595cb3644154ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 26.5MB
        • SHA256 f84ba1327b5f63a4c93040592af758c5b77d8edcc5cbbf64eca0da1b9b2e0a44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 26.5MB
        • SHA256 c1c14e2a29b311ce93159cb30592314cfe409865be6c34162b09904da9665c11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 26.8MB
        • SHA256 d0dae94ac7b4ab7b5dfe7fc080c69306e5ce984f015c0208afcfca097e83e099
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 26.5MB
        • SHA256 97ee2d68c841e43bb0a37028cbde78e2065dc1fac31d1442ff2257ec8595bd25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 26.5MB
        • SHA256 6a8e1c2e903dcd2b6a5a05113f6ce6fbaa68f12956fa74f032e7218b20656a0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 26.7MB
        • SHA256 b53e5749cfa8e5b0c26a8561a1dc6f651dfb3305a373e6b5101888410d92f003
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 26.5MB
        • SHA256 ce798d8930e5456094a286a9ce81c650ad1c37eeaf2acfb15406fcbb41ccca4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 26.5MB
        • SHA256 6bdf6cd13ca3bfa650847cfe1f392daf389a8dd20ff9ee098bd4123e82cdc8fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 26.7MB
        • SHA256 18e649fca025a5ca71e9df4c7cca159ef4e0a49b802cd0f05d1685b8eafc011d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 26.8MB
        • SHA256 2e1debd5fb90fdd81b22460bf740b44781cf79dfea8b5ffbfc6bcf4a99409083
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 26.9MB
        • SHA256 d78f8a9510253b1188cc1b5b0d27635ff1e751c732bdd44b16c2b19c8f1c77cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 26.5MB
        • SHA256 e109552850c3bd3e78cb8613b021a0f391df4e1aa1887a069dc6ec043d939ee8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 26.5MB
        • SHA256 b2ce03ef3280253bc1ae07352d888db2e0cc6ec12f72c6292a6735e12a4a3fc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 26.5MB
        • SHA256 4b807392d902c49d1a4ca4b433750e08cc82ff8ef772a73fc3430e2c245094d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 26.5MB
        • SHA256 0fb56a8a40b504065b6c4effdbb47b1969efc1609e33416e937d2371f593fd79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 26.5MB
        • SHA256 5f7b9d6c715b96da82fbe171c4187a5f896cb6179e7605006eb06aaa95504333
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 26.5MB
        • SHA256 9044afca4e286048b91fffd19b515afe8996ecc8f9ee1f842a115c5a3bf9c248
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 26.5MB
        • SHA256 b9b29f9b127adf19faa84a18f51196765a608ed7b75ad4e0a47f9fe73a3f5e29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 26.5MB
        • SHA256 d1fe3b84dcf1bb9b3b5c81f8903f991421eb06894b7e522cae06974e3d7d7b3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 26.5MB
        • SHA256 3f51aae36f93831a6ccfe24b0c462f68631942e784a83601ac278496c203005c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 26.5MB
        • SHA256 acbb6b22d0a7b00b8ff89ff5debc7a6bce6e777a59bf7fa056239eaa36a63fec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 26.5MB
        • SHA256 924d6e2403461f8679f0d74d62af93dbe0c76cbee3060a8a7fc39c4d30205cdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.5MB
        • SHA256 0370c74f58be6d45a1d06841fb69a05dc93a1ff66d50cf88b3f76dd71ffef9d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 26.5MB
        • SHA256 665f2f7d030d1a3423ab3cb994fad4f7394737fa50e40cf35827091f701af86e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 26.5MB
        • SHA256 ea950d508c50898f9cf9e1c57f036c787a41a6de51df528dfc67a1e0e888e37c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 26.5MB
        • SHA256 e4571b185a2e659e9d3008b84c2724d7bff706cec3404f95b380fc1794169212
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 26.5MB
        • SHA256 c4e9065f4eef2aad9cf969ed11384d666d76f5e3bcf83acc1cb42c01c8f92213
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 26.5MB
        • SHA256 e828c1332e08845d18fa8788213f77e40617668cd4919e0376f0a8cec41f4f89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 26.5MB
        • SHA256 9934cc58c90162db5f26335c3d8b7817c02913002b3e74e7d6c161f0755fd602
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 26.5MB
        • SHA256 f03cf6a39481d2fd58645b925f71450a4fd4fafe3614854bb092c76d98e90fae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 26.5MB
        • SHA256 934a96103b04711fcf9ec7194d261b44fee59f80930fc4e31606429f2ea4ea56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 26.5MB
        • SHA256 f3de2c2584404dacb4393b2d099347837c6fbece45ed5719283dee1d2dc4eb0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 26.5MB
        • SHA256 0cca4f026b61c77cd0ea039a6df22b7d676ec2686127aecdaeb13cb69544ee01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 26.5MB
        • SHA256 d75752a71c1ae28a24ac3fa13d8cf5e86defb66674fdaa0c8a798f167b06556f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 26.5MB
        • SHA256 4eba6a5ed5ae655b1970fd7fb497c845690d5eeaf2ab9a7fb93d41295c1817b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 26.5MB
        • SHA256 5be313cbcbd127c116c480ece4c1e62f6b95e3e54eddae5a6c3d7466c23a76d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 26.5MB
        • SHA256 1f378e70351ae2df0536752ac57aaa306be6dd4d3af2694fb96997371c0042d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 26.6MB
        • SHA256 2fb15c9a6fa025c10349eb4d68dd222b7c2aeef93bde2816987224445e9ca403
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 26.5MB
        • SHA256 a042a58ad60f2dadce09c8be7e1bc442000ca587cf5e1e1cee83742534c015e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 26.6MB
        • SHA256 8c2bbdc8435f85611ecbc2ec4ff3bbad78df1d8605b986643916636324036444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 26.6MB
        • SHA256 522b6303ca1034269384b582433ea647e09653f18602642837d167df4771bf38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download