Overview

overview

8

Static

static

3

2026-07-01...as.exe

windows10-2004-x64

8

2026-07-01...as.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    121s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 17:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_3846abd841f0e70cf39a8296fea004d9_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
  • Size 13.3MB
  • Sample260701-vs4l3aa13p
  • SHA256 577961b23228486776025f385abcdd8c75c8d08af7780db30544d150cf896cf7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_3846abd841f0e70cf39a8296fea004d9_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_3846abd841f0e70cf39a8296fea004d9_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3912
  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_3846abd841f0e70cf39a8296fea004d9_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-01_3846abd841f0e70cf39a8296fea004d9_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3692

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 14.3MB
        • SHA256 2536eed3685bd5ebee401fe50c5ff621541b21dd7e363bce6d6cfdf2c3041eb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 14.0MB
        • SHA256 c93b4a21e9fb35fda326c7bb653c7a5dff9153050ec88df26241a9ca0930e3ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 26.7MB
        • SHA256 4c8035a778eea54f5f886792db405027359d817cef6059b1aec6881b0e58e36d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 26.9MB
        • SHA256 1a340ac79ae1dec7745ccdb2a1620f55ac85103ef000c81f171ace3d81e97877
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 26.7MB
        • SHA256 b38fb73918e66247aba6dc286964d16716f8afc576691e2e531975c7955152a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 50.1MB
        • SHA256 8d1957860edc58c57369f96de3f00e9016ce6fff334b09f0e30e8be3302f306e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 28.8MB
        • SHA256 937a67decea74112cfce31de95c2a9b3812b9e8714bf57d5829a4e91b4f73fd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 26.8MB
        • SHA256 c722a403d2c0c3dc296e9e80fbb5c73bc7f973c55eeb07b92d017a784e95798f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 32.7MB
        • SHA256 14e9fdf819fb9d0ab8ce758c8df075486e5b5b154f5ffd12e702d1bbd15b69ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 30.1MB
        • SHA256 a7b8eea0ca2e27a455d2e803f3f229327e63187bf1165da20ae6bbae25d95685
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 28.9MB
        • SHA256 4bf499dd12fb3d4557923a26f1648c3bbf602adfe0faea74c7fcc83b793e3b66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 28.5MB
        • SHA256 8bfa48f381e8bda9b4322781c8f563915b276067122a5c88008e9f3b59f98982
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 29.7MB
        • SHA256 80172ea99d066516d708e3be6e650d0d11003523bf1d240e57c49a430d0bbf0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 28.1MB
        • SHA256 e31564bc3c9c848c61b9ba8764aaf8c11a26c3dd17389ac8ce28440c5cdf2acd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 26.7MB
        • SHA256 6e5afca1be046d22a87dac54aecd4d8c6cd81f2fa0968515679545cce9970de3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 26.7MB
        • SHA256 b21d79fee7ba896658ed1f84b5ac35c3d4ecb03e89f4461f5e61cf67c856fe09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 26.7MB
        • SHA256 b89252cc7630c8c8b3e6e67a3c30d911373da04b5199b78d41b62124b0530072
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 26.7MB
        • SHA256 c47a71c065a4d7237632e94c8ac61399c4564b1c5137cd4d5ba90a8c661e4478
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 26.7MB
        • SHA256 f4d8f8c183f015daff57a5323f1623d3ff6c95bbbd9a87c2e7a237c43e2c4628
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 26.7MB
        • SHA256 5b8a11e167a75fbdfb7c3b0d2cb1b52b64becd749a5b1c697670fa08ae42b7f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 26.7MB
        • SHA256 2176039f2639784801a9f97004138392ff72b5bc15f835dd71705c5cb25685d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 26.7MB
        • SHA256 b1b76cbdc9546fc7e325242abd65c74afb4ba919f34b472a6b63f72546debe5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 26.8MB
        • SHA256 e9c4664aa7ddbf9e91a9d8838b1f099573e69bb5cf46f3b275a104d84a512a8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 26.7MB
        • SHA256 12a2625db1e0962c62adfe73c3eea9ef1c88428d0d90453f1e178387f1621e5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 26.7MB
        • SHA256 47aa88ea011e85dcfab707d670648368ef1e16c64c76b7b3d093b70ec1a97a46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 26.8MB
        • SHA256 63daaf1d04ff323888b9cd75a2e59a92343ffbdf0f7ff048bbef82e8d402efb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 27.1MB
        • SHA256 72c07058bcfdee6d898dd972d7ea5cb56fa8733e5c9c36f283d7c193993887be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 26.7MB
        • SHA256 7064cf0335a7102880c447f3dfb4a9d916993b8cef0249a49ecaa5d9ff25e25b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 26.7MB
        • SHA256 4f6c4861c2140b12a6c26522ba4743cc9f5fb83986d8dd3904af3e91a3757faf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 26.7MB
        • SHA256 2d722d2fa6dfa55db926d127105b61e815af5f2525a0007de1ad5f56caa29458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 26.7MB
        • SHA256 5d4425c18523ef1e026461ce62ad1da87a20bf0bae609b2e0a9a91dd372498bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 26.7MB
        • SHA256 5392669f4e1c8d0e47eeb1b12ba57ed620af3df637bf37ff8030f0c62367f6c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 26.7MB
        • SHA256 a3dadd86b1bff0ddd5a1e0af4912e475691761a2f213883869123f6449cbe87b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 26.7MB
        • SHA256 35f5bb800613d2295ba858fe541598c3687426512e89caa42e6192b1d8b0dd2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 26.7MB
        • SHA256 4529028c068474bdf65f46ea2f748d5dbd21c73e007fd6371d31316029c22521
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 26.7MB
        • SHA256 5b98dd4fd92efc3c85cc373e7953bdf1fe89333c1d3c310003c902cdf847ae5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 26.7MB
        • SHA256 d333fead752eeb9a93b2e9d3d2b412b622a96b82b9f4b0d42597f66c2a4a85e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.7MB
        • SHA256 d806d9057156e55fc52077c8e229e55f269a4302bf989e438a0826af8916c20d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 26.7MB
        • SHA256 c04eb60048a6c6323178f64d637ad4463fddd3c1fea97491af52adc4b50e8841
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 26.7MB
        • SHA256 4437dd9af8f2927c7a3f21037fa2d9d436813bda30096c097eeaeaf9eeb8e068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 26.7MB
        • SHA256 798e436e536bcf589b454c17a7ad9dacfbe5ad41889f37665873da3ef80eb78c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 26.7MB
        • SHA256 e010619890ba874b9fe8aa1c6ed06bd9dcd5b32b2b61fd7fc732e4a49780f381
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 26.7MB
        • SHA256 cad1f3ab9537e66ceb8885e04510e708e948dd728d220508ca2ed77f6a8d20cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 26.7MB
        • SHA256 76b3c0de9b41ae183a0cc9ccdd8b1fd915cc0cc33a289ec112aaf40765a9f955
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 26.7MB
        • SHA256 e227efc905ab7e5c0b2a3eb5fba3583f6d35f4f1310bea43fd4115794467d62f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 26.7MB
        • SHA256 1d8c87ee466e798d1d0b8ea80c7a579f197b66474076224c1feb0f27501c0834
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 26.7MB
        • SHA256 d7894cf534a3d3eef0534fac67b0f1710bf6f57d14acd9ea3ef619c1b16c20ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 26.7MB
        • SHA256 4ef6d05d828e72ffd7e37b6de3f437733179c2a15d736509eb1362773a680583
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 26.7MB
        • SHA256 f5d23e25b2ad142e0cf690e6792c75288b0a87fb05ced5e7242ac53dfaa3097c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 26.7MB
        • SHA256 99e92a9791f5516f97a78971a56a1338fc0907fe5cff9a1844cbdb9a52b16f8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 384KB
        • SHA256 3e4e65210d0ce663e458df3dc7915e7345a65463edc2c4781b0feb1a0cd3389a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 26.7MB
        • SHA256 ff4f14ae3bcc37e62c1cb8ef9f2d0c89562f79952dc75664f5d8cf2436c55087
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download