Overview

overview

8

Static

static

3

2026-08-02...as.exe

windows10-2004-x64

8

2026-08-02...as.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    147s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 23:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_cbb44bfb878742c50415d153599328e8_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
  • Size 30.2MB
  • Sample260802-3nsb8sterd
  • SHA256 81e033f6d33b6936e28fef48ae91187f7268d468ab58dd4e5f483b5c574356d0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbb44bfb878742c50415d153599328e8_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbb44bfb878742c50415d153599328e8_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6008
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbb44bfb878742c50415d153599328e8_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-02_cbb44bfb878742c50415d153599328e8_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2876

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 30.5MB
        • SHA256 0179bc89027ad108961e6ef5eb4ae8090262d2ba01047c927a50a573b21bdefc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 60.5MB
        • SHA256 d930c456bc57fbf6b90ecb5decfb0f08f62e3b692810bb17ffe11116612b3983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 64.6MB
        • SHA256 40ddcd37e285f71e6369859ed3f1ee74b219d8d5ce0e1f372b6df8220800fea7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 60.8MB
        • SHA256 54bea74ef4e547a3f8e6f630be1165c26c0281cb4e4f9ef038b092a9726e31f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 32.4MB
        • SHA256 4a2a59123c8f1e8912cdb79c9222fcbf7faf4c870fc3a50fa7c88664cd6b6d93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 60.5MB
        • SHA256 4b99b960c56874a7f4f269590b47ec37a92515a1795124bd28f8f574dfeb59cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 66.5MB
        • SHA256 cd11b2f5d2d87e17e1e6773af9a295bd8d18d0db1ce0c42cdaadcd3e918ee2e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 62.2MB
        • SHA256 3164b379ae8ab5cb0b152d9535abdfe0beb985144d86487aead565b0b5176999
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 63.9MB
        • SHA256 53561d3a75f7c6304a44fbbc51b2b7b45118a0939204495651cb213361148518
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 62.7MB
        • SHA256 aa0807ca8a3bca07ce2eb2587cf7f09160e907b7103fd49a927e38eb9b5b6da7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 62.1MB
        • SHA256 b5f7cd46f957118553a48e76788f8f14ce8d6b738557b3934704bf5d829889a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 63.5MB
        • SHA256 493e86e869c158c6270dc36c06074b2b9a9bf5b81491afaf4fb12e6a5dceda9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 60.5MB
        • SHA256 98aeb42078bfeb49dd98f8a35939bef353319b44d6c5864f548eced464de7203
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 60.5MB
        • SHA256 44f0189cdd95e1ab69ee1c52fdf055590162054eb1862df620a7f03737cda53c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 60.5MB
        • SHA256 4673fefdc1740a4e904a25078ac27c5c885e3fe38d653ff410d53e579a0b7545
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 60.5MB
        • SHA256 2c2bfebbfe01cf081111f7fffa4f3412e4a3b7b2708eafdaee0cf60d239886c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 60.5MB
        • SHA256 2a02ccdc769bf72a64c935647897bdcdf0b3dc3e0538d55e594688c424ea7f1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 60.7MB
        • SHA256 7c57c581dc03dd083ef9778f464dc597310e8374b1eecd1a4412fb81b491a81f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 60.5MB
        • SHA256 740632230f9e69ca8d3128f3bbc2cf7772f6bbca5e160db6a906c54e99f8fe9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 60.5MB
        • SHA256 9e7babe70e233b2efd7d9e07a29a6309b5376d6c3a8681d5b603ea538e0290c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 60.5MB
        • SHA256 ca5962645b389116f7e27f06ff27adf13301ee474b489f93693516e0b906b797
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 60.5MB
        • SHA256 8c00b3cb13ffe36fec411cd62733929b597f2590d030609ca4ce8fba7244c225
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 60.5MB
        • SHA256 cf8b16876e203427f6163d8a5bd8010e95ba4650ec0861036c04f61cdb3aa85d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 60.5MB
        • SHA256 8710537e438b791494db4e3e820e883052baabbaf9793037122babe7cc8c075e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 60.5MB
        • SHA256 92591f1ad17924702dd40a8126357da0b8c29f784e9209c32af330161bdc255a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 60.5MB
        • SHA256 dabe5d2b8073e85c0a9c697039a5488c3a546952b7e48180515d6c9430374552
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 60.5MB
        • SHA256 efa0b7d68d425541f1dbe8eaa4d545cfa81185f987047d5d5b3c206edffa65ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 60.5MB
        • SHA256 565630eac1ce248186115db4538c98ff69bd450a60220628dae9f5209418e4b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 29.5MB
        • SHA256 67578f229044d76daea4405178348599a3e75713fe1788b8f902611a297618ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 26.0MB
        • SHA256 297b602b96a8eb1ef72905d16c2443dd6555c558c833000c2a09d68b2830a40e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.2MB
        • SHA256 85fa02a4c35976bbde4f406efa883924b8fa85d9f5e89246f109d837e430545c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 21.1MB
        • SHA256 acb3a46e042535ac2e41c82110607aefc523d7d25119f9239149e77fa0647471
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.9MB
        • SHA256 80a7e18b49e7dfe7d7e66fd43bca9cb2efa364510374a43e9c6023ff970ad19e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 17.6MB
        • SHA256 93939e391f3c15f31a4fc5e9325723bd94e8f73c5c23e4d74f00fad6da913520
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 17.5MB
        • SHA256 9fa9844d4b0fc687f6871a21bfd7ca014e8804236477848d6fa0414c4b18148c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 14.9MB
        • SHA256 e855e7450f360b23e8d3f6afbc40d7dfffa300c8fe9b190939950616c2b6ce8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 15.6MB
        • SHA256 48d50c7b5baacaa2d78c4428d26a7b148773a50913dbda1218bbf3ea01fd699e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 15.1MB
        • SHA256 a6871e1faf8c256370a233aa117718b3574e3365cdfd5bee7a621b5582a3d46b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 12.9MB
        • SHA256 a1aabbb40cacaf84f4d38647c4437012fcb3335dd361cc3a34bcc8f869b85c47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 12.5MB
        • SHA256 bac68441119e18345845fbecb8ebc6ba7d96a637da6759c1c79652f793869fd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 11.9MB
        • SHA256 921d05006ffffa5f4b54621f74bc44efd7c50bfe811de0e4619d5ec3a08562bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 9.6MB
        • SHA256 dc47213fe657a19f1821867e2bce8b06984285f3651dccf18cb85f6139698d9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 60.6MB
        • SHA256 b31f1d5061f88dd5b1d497cafdef639bc9ce4b4614ed3c335ed2bc7f5106f942
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 60.5MB
        • SHA256 12fe8ea6561bbb79e52e07ee93efee787ca533084a61cec56e758f010d1de56e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 60.5MB
        • SHA256 29ffbe10d76ef4019ebb40071af0deb625e0b56c945c52029fedd49f1581e349
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 60.5MB
        • SHA256 738f95feb0a2e822c16ca5a793bacd03a1b31dbc341ca32bc7d0f2e35dd2d00b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download