Overview

overview

8

Static

static

3

2026-08-04...as.exe

windows10-2004-x64

8

2026-08-04...as.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    22s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 22:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_b4ab8ad13fffa9765f18c96162a16018_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
  • Size 27.8MB
  • Sample260804-2cd5sszscv
  • SHA256 4d2314ba2e4d9e5ee23a7a393a3223443a4150d4b0b491d5f973090f67008e8b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_b4ab8ad13fffa9765f18c96162a16018_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_b4ab8ad13fffa9765f18c96162a16018_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5688
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_b4ab8ad13fffa9765f18c96162a16018_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_b4ab8ad13fffa9765f18c96162a16018_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2980

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 30.0MB
        • SHA256 789ff850c7194075ade3ee13cd526e64dd424179703c333bbb6cf8622c2a3e41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 29.3MB
        • SHA256 ccb94a7df2cca95242e3749513a65f6d7653db3f96bfd7336ce7619779b51855
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 27.0MB
        • SHA256 560c1dd7b1d7dfbb04ff4bd09780a956e324fd0bd9c5b4504c3fc8304537948a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 27.9MB
        • SHA256 c908d849648818d2edbf6fd3583b352397468c370cd89e9801eb8fdb8e8e1153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 27.8MB
        • SHA256 4d2314ba2e4d9e5ee23a7a393a3223443a4150d4b0b491d5f973090f67008e8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 26.1MB
        • SHA256 23b6d290a4ce4fecea2b3e1ea000e20633954fb40881d344f3d4ae19fe1bf3c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 27.9MB
        • SHA256 8ae74a70440040b97a8e8c7849c9c576ca977bf9de0368a10990b50eee00ca31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 25.0MB
        • SHA256 cbe8643e366a1de2eb590d6696a9db113ed5cd3f5f184a176aef1f993232921a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 25.9MB
        • SHA256 c8011ca030752abc361e35d9ea43e9f68a11532b34d404b974b3b9746e2016cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 23.9MB
        • SHA256 873000899c90d967cfa125253d1ab48a5d40807d1afb303f2b6277b7905d9e36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 25.4MB
        • SHA256 d25fa7353d4c48bc3a03d60cc7509f6c4385a160e938b4bdd524b5d9a71faaaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 24.7MB
        • SHA256 3f1471b45ba6f907b76ea90bb0a820eff372ae754c58963fb0cd3bdb2c06cb7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 31.8MB
        • SHA256 ca39b09db76ab9b94f1ae34c29cf35593755af636e83f7d43b937705d68862e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 28.5MB
        • SHA256 676d662e86e4cb0ab2a455f295c4e207e99d8d90df75d801c862bf0efaf8fd5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 29.2MB
        • SHA256 9c37ed81b53429c1fa4b6eb520c1e9a9c1c9219c60c8fd96174a7e5840a9017c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 25.8MB
        • SHA256 6e4c3c28fef438f6f90a3b3a9dbdea6c87bbcdb9e1cea1d06228e96268a9438d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 27.2MB
        • SHA256 39d1221202a5193015370ad2afd44157739ba067721de48ed5e655f8b7919a74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 26.5MB
        • SHA256 6116b9986781bd03d1cab8b702907b0605cce83b77cce8cf67ee34dde7c0a953
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 26.7MB
        • SHA256 07e361ec10291fd5795b699082c490ebcda992237c84b4bcf8f50054d096ac0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 21.8MB
        • SHA256 86c2c807b77e6491ab38f0adcc39075d1d54fafd2cf5cb32c4bca5db7c9bb118
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 22.5MB
        • SHA256 07738e396886fe1070711ed29bbd7dd8ef67a7538cede5884924a6e334875a2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 22.8MB
        • SHA256 727d2cd05397c5acc1c39334ad18bcf190cef821add28f445580d623c2d2d716
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 24.4MB
        • SHA256 4f3af88a7a1c951910f9b9bd0370b083ff82de033d9152740c5b8996fee57371
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
        • Size 21.8MB
        • SHA256 c13c6ea6662a9aaa68dcb338dc36157836f3e5aa0336ba743159e049bee091ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java.exe
        • Size 22.3MB
        • SHA256 5f6705d4f8dcf0fccddb2d2fefa6343e407d634f0fccdd8e5ea95fff19f60b27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
        • Size 26.4MB
        • SHA256 1bb1922e9e8a82bd931301a331ea40c03be15d52c3a55ea596dce66469af5869
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
        • Size 21.6MB
        • SHA256 bc7891c4a5224cd13000c04ea0a69dcec1748da8e794c368d24a9ddb4c1c98ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
        • Size 25.1MB
        • SHA256 e74883264cad772ff112123f05b365af842746ad9ef2ac17654dcd99a755ad6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
        • Size 21.1MB
        • SHA256 93a79d981e7a5858ccdb370c58f176daca3ed10bebca5e468af268e47c9f577b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 21.9MB
        • SHA256 febc7a3544f47fc3cb8f7d14a4542985a66d8e02f54d89eace1581fbf9d0502d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jre-1.8\bin\klist.exe
        • Size 19.9MB
        • SHA256 80a7e18b49e7dfe7d7e66fd43bca9cb2efa364510374a43e9c6023ff970ad19e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
        • Size 21.0MB
        • SHA256 579b346e1b797b0e5310260899f07e11fe6883bb4c595ce01bef0f02481e231b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
        • Size 192KB
        • SHA256 56d5b720b4307ef448fb38ef6495ea0a6fb25e8bfa8f9c140729b820c8e0cc1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
        • Size 26.0MB
        • SHA256 297b602b96a8eb1ef72905d16c2443dd6555c558c833000c2a09d68b2830a40e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
        • Size 27.6MB
        • SHA256 4d63b17396742a83b4b13007f61fa3429c7757847bc6f2906c8c7c682cbe9b22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jre-1.8\bin\rmid.exe
        • Size 24.8MB
        • SHA256 78d560d2d7e9af7c5abd6390c439b0282e619ee41dfda5add62fe39736715b82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
        • Size 21.1MB
        • SHA256 acb3a46e042535ac2e41c82110607aefc523d7d25119f9239149e77fa0647471
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\servertool.exe
        • Size 23.8MB
        • SHA256 1f82edcb45692f18b8a241f2e6c07dcfb474b120e1958561cef42eea74e375e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
        • Size 25.8MB
        • SHA256 700abb6cdb01a805c6c4d15d293779ed841c17d29999e1e055d25c3aeca084e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
        • Size 24.6MB
        • SHA256 962902cec654f489058cf18e70c892374b039df05a91b0666866eafd63f4faa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src
        • Size 25.6MB
        • SHA256 5da63f1ab75ac772318ea47c43ff36b6096e0ada3facff6fcef9718a9c853d19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVDllSurrogate32.exe
        • Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe
        • Size 23.1MB
        • SHA256 4eedf45deee989db06422ade4676c1585d753f8d87daece99dcdbf6228972ee4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVDllSurrogate64.exe
        • Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
        • Size 19.8MB
        • SHA256 bd7287713887968084656cfa289bb5b1dcec5cb0391f3f8fedced91b12b7bbd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Integrator.exe
        • Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
        • Size 19.1MB
        • SHA256 a9a226a2789b9ffa0c92ee3fb992fff5dc73d963bcfff7006ccb90b3ff526055
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Mashup.Container.Loader.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
        • Size 23.4MB
        • SHA256 f8e9864eb12bc52a776842adf61ac8a14c3c4acdb0644f59fd8275056a0ec453
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Mashup.Container.NetFX40.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe
        • Size 23.2MB
        • SHA256 93b38b1e83bf750eaf541ca5308efe0ace266a60c35b0e97443228fde6ca8cc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Mashup.Container.NetFX45.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe
        • Size 18.8MB
        • SHA256 50ff60cb8306b2ffb47fbd4b7bf9359e35e321913e5602cf8e687f1eca6c1db9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        misc.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\misc.exe
        • Size 22.4MB
        • SHA256 52cf7a9280320a6bd55e176cd7732c6c22476e506b3f7f154d827927181edd90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoasb.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
        • Size 22.0MB
        • SHA256 93b115ecf4445f3492f3b59e7617296cb4bbd7da9f5107d19c0e1d285dda10f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download