Overview

overview

8

Static

static

3

2026-07-01...as.exe

windows10-2004-x64

8

2026-07-01...as.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 17:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_414c4a21c91b887677d46d46e66a9735_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
  • Size 13.5MB
  • Sample260701-vrvmrscw7x
  • SHA256 0e6a1345fb759466072e81acaf516b6678706b231e9f56e6bcdcb333d9426f64
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_414c4a21c91b887677d46d46e66a9735_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_414c4a21c91b887677d46d46e66a9735_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6012
  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_414c4a21c91b887677d46d46e66a9735_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-01_414c4a21c91b887677d46d46e66a9735_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6096

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 13.5MB
        • SHA256 3aaae85f8f079c7d9ffcdff777e22523af5c3508aed1013aba6b33a3575cd93e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 13.8MB
        • SHA256 91e10e630a452718c3f0c003e5b639887fab74f581037236851996075b579b51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 36.9MB
        • SHA256 2b03544e52a7091efda5a4ec14fd6059a095b0041b109b59a7777f934981c7e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.6MB
        • SHA256 708b28bcb05a57ad1df17e9f344c8f2cb1ad18c1c746286c383e501577af0b9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 33.0MB
        • SHA256 bd78533169e0322de531edbf382f9dd190d837b231b6156897139f4c412d95e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 28.6MB
        • SHA256 51086249ea7ffa4dcf936d37bf1125070c0a96ee63ab3a1967a2bcde27eae70b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 30.4MB
        • SHA256 2453587aa1cec7439e1da276a1ee943193be508ba674881ed9e4fd4091f73918
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 29.2MB
        • SHA256 94ad3c80c0c93e2548cb85a6b1b034d5a6d129027813c0242fe56e67310e74dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 28.6MB
        • SHA256 1ae9f67df8587315f54b141beaf73aa1fb3d607a3aa3299aa4ea18996f0f0c5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 28.8MB
        • SHA256 912a50bff2efd8b1eb881b2af267c8f924b6fc0ea7b1d03d234894732538f765
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 30.0MB
        • SHA256 f584eeb356eb2627364b97ee9a795ca302875c6c59b10c2fa52f5fd74217c62e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 28.4MB
        • SHA256 48b2f27652403172cd61da0353ab8972cf7172feec3b1bf0a9860c31830320c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 27.0MB
        • SHA256 b4752ad30d61605d30c05d0ce43f44b0d8b16314f9cf46f7f60003954f632fab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 27.0MB
        • SHA256 39b41f800118b7448ea9914f655c99c03029e81f50150069f02550944069b2a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 27.0MB
        • SHA256 1a87603fc715c29c25bcb3beacb5ab081fe21e5c01f745d1d34cdf862049aa12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 27.0MB
        • SHA256 e6d63fded0542abf4e1cc87ed3eb43e87dad6f74417612017b8c28570763e60e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 27.0MB
        • SHA256 1b98fc842ff22328cdcdeebd12dee27a32b5c99ac423e1b71c0eead65d365e47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 27.0MB
        • SHA256 138ea369df62672e014fea8da72c3bf1c9b68d209df86f8db06a8735849bdbe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 27.0MB
        • SHA256 ba9de9775238603aef91bcd7c961350bc91b0e20a48420ddcc53cbb23ec57bbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 27.2MB
        • SHA256 2bf3084fce4eab27d4774986af55d7f2d2f389f83ee41510a5435b7222a684e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 27.0MB
        • SHA256 93fe20bea0732739059c9c37173c19fa92e9c8f444606098882dddcab7feef07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 27.0MB
        • SHA256 4fa5ba5554ef55acb85eeb217f4bc4a7bf646ef7271a0eaa6b8cc949e66b67a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 27.1MB
        • SHA256 b2d48212dc91ddf04c5f6367808fb8bb4b0d885ab3981c5b3cd7bd51bd9d3b58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 27.0MB
        • SHA256 4d75c1b5234ecebf3b7a6e06bbd17755bd03e99d2e4c02974f9db7b5263fdee9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 27.0MB
        • SHA256 8ec26ba69110bcf10b26650738aac596fc768d8e4cfe7ed205200979929481ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 27.1MB
        • SHA256 9211d91bffa67261175993577c7e67f0a16987ff912646af260299011336bce4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 512KB
        • SHA256 fded04c6d782f8085d397cfe282605c1f1fba531c6920ee79072db343ae14316
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 27.4MB
        • SHA256 e0372b0b1908ceed949abd4773c5cc2801cf80aeb502fb7bb3b516d34e6cc8e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 27.0MB
        • SHA256 c5a8e7074d5d15197323ee1c71c82d08cf671b9139a284267feab94fbae097f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 27.0MB
        • SHA256 894c71e4e69cbc6306fa1c30d37f6af0d5dfc464e35fa3a9523327f88b7e055b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 27.0MB
        • SHA256 e3e8f746ae39a047866b192348a784d1350986e0fbd30b864f043c67f5a1307e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 27.0MB
        • SHA256 9cf43f7f33ed0a3267c559fa113f4bca1921b657b39d65957bfbc5653fb76d2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 27.0MB
        • SHA256 fabd10bbd2b292eb53652021e6af68c1f468e04d1657c481c0be7863572fa9de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 27.0MB
        • SHA256 59dca76befa59329c66ae6908e57832a8250c73cbd0d5d78fc119007cca79f56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 27.0MB
        • SHA256 0265b9707d8f142c48d4720bff4526d0e8ac55a5cf7d582326bf7c47c90c008e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 27.0MB
        • SHA256 6e6bf65f2a62d36c1845a730ced795a7b15cb921915e8650acf906314b684610
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 27.0MB
        • SHA256 353e4656bd76b32d8a5b4f8ceaafd0a92257b92b02229608df598dcb14e7da14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 27.0MB
        • SHA256 1f8fc0e0ac7519aa9af460537ee9a930e057c358abfcd1246ef68511c813f81b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 27.0MB
        • SHA256 c83ce81dfabdac234da15f2304ac5f8add0addc26571f6d9cd200e13971c5818
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 27.0MB
        • SHA256 5e1ceadee1abc7e9bf7e510cf090f13e7e91d48fc2b62a314da9b3c8c712948e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 27.0MB
        • SHA256 2bebfb4e6a15ffd7563d564971ed1a341711ddbedbe70e49c7d3829a2fb5485e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 27.0MB
        • SHA256 0acdaaeb5d22a9dc9553e1541ed7396ec9666a37722e797004d29258cba94fbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 27.0MB
        • SHA256 2029a4796d1b1582686f134067309ba111611ebadd33891018ee165009836634
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 27.0MB
        • SHA256 6c01c17531e8598daab388186748ad04817a08ea94f813a8fbb96c4bd8f5f6f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 27.0MB
        • SHA256 132010c0fb5eb4251a92a2c80c6270233bd064afbca54fc884dfcc8363ab0426
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 27.0MB
        • SHA256 cc1983d429c4b8a99610d0eb3d33b6db0bdd9b4a165c78dc8a1edf05ebd5c224
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 27.0MB
        • SHA256 6895b74d50957b2dda383d5c3f7395f6cc05e470a31fe683f06d1ec76156afb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 27.0MB
        • SHA256 445f0d995bbdaf690226a7347541a643b9b00fd9f17042c2bfc65289fd050b54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 27.0MB
        • SHA256 23cf032a2f47f46444de4007300dd8bcce7f2af0fe0850ac4df9be943d69692b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 27.0MB
        • SHA256 12053d481477059abf081c66e01bad9f1c1354cfce462f357211f7a07ad6ebb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 27.0MB
        • SHA256 e16084940b42156471f9aba64a587ce3169171b8b690a4cc750d5f783503990c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 27.0MB
        • SHA256 afa37b885bf20ecccacd6dea3f04942b793a289813affb168fef9c2189791cdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 27.0MB
        • SHA256 9f0b188deb30a9903c035f5dcd7e42043bc92d5d76d1b4658a7de7c2f47b1005
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 27.0MB
        • SHA256 0be397f552f4274569e9531d8d627ad936c95d1b13e98173196d38975d637642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 27.0MB
        • SHA256 e1fa864801693885a7054cced0624db42f7f6bba5e750f6c4869e661c16c85da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 27.0MB
        • SHA256 efbdff71ac65d07e71bc099ea25e0460b3369916bfa81a5aff344fc44c74cb32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 27.1MB
        • SHA256 8892b014796a2dc5eaa684b5d28d63b9993b5946fdea66c8a6847805247a95a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 27.0MB
        • SHA256 8a3341fb9d92e815f5092780174822609a75f8c13ebdf69ef8da82f4752fd650
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 27.0MB
        • SHA256 68db133c8f9c655d3a3b139d105bfa226264f48c2d3ec9b34375583e7a21ad9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 13.6MB
        • SHA256 32e892908e2a75e394338e2968600a7749b47f43428cee7eed6530012b2a0e66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 27.0MB
        • SHA256 7f35f6119fa8ef112057c3241323f5220f3d3de7518c5c6b6cdf6455c4404686
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 27.0MB
        • SHA256 40601afb04e0688e9bbbec47d84fdf8642e1a55f89b0aec1a2cdf24934b91da0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 13.5MB
        • SHA256 eb83ac3c78bdcbd72d2851e940cf6aa837af6886c321e0ec81ee6d92b8d4d418
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download