Overview

overview

8

Static

static

3

2026-08-04...as.exe

windows10-2004-x64

8

2026-08-04...as.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 23:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_0172d12a5abc32c0af5712976e18a352_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
  • Size 26.6MB
  • Sample260804-3f7f7afr2x
  • SHA256 562e8d8081df56bae6996f39037bc56e23a5786550f1409ff9be169f3f9bd708
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_0172d12a5abc32c0af5712976e18a352_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_0172d12a5abc32c0af5712976e18a352_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1144
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_0172d12a5abc32c0af5712976e18a352_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_0172d12a5abc32c0af5712976e18a352_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1208

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 27.2MB
        • SHA256 51bd3b253d6d295b35997b7b837df6e78f67b3d5e8e9e0b96ba3d8ef6f760de8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 28.8MB
        • SHA256 b4c691cc885afb3cbedea7e5cf80eaea10a75a32ea6c27658a06b1705b7687e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 28.2MB
        • SHA256 d5dca253c1b966357c66d9febfa88276d7fd1d4eed767e18b79e2add361a1e02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 26.6MB
        • SHA256 5ff826bf40823c26d7d6d1d0e002444cb259d5bcce5d48aa2468993980225ec2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 53.1MB
        • SHA256 ce72cab930a3c2af98e3d41fae6aacd8268e5917cbf91c9a00e37f70d13444e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 53.1MB
        • SHA256 75fb6e5b7cd0b3e6346de807e50b8b80b4694cc6e9f4b2a446db5fb2cf10b46e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 53.1MB
        • SHA256 a3da74bb4eeb11036a3a349670c57dd6cee56e649468230f6c197bd28fa226c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 53.1MB
        • SHA256 fd43d5c85d28b1b699bd4637425bb4f02d1336569c725ca32e6fec80137520d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 53.1MB
        • SHA256 d7e12e6b40ccecd1a67501de4b03ad6b1d31936e3bfa13461e04d6d7077a529f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 53.1MB
        • SHA256 ebb44ea7ca7cf573e7ef2f397fdf06a1f09a9dcd03b69f3f9a2a69472ddfbffd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 53.1MB
        • SHA256 2a0f76da9acd5c12d702ffd1dba9c1a1d341f9d857c1a04abf00f0364ad5378b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 26.6MB
        • SHA256 6666fe3d8f024aeae6669688411da94fee5b5fb27118b09eead490dc0cd0771f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 53.1MB
        • SHA256 ae82a86da4ac03995577c3c5e2113c6eab26c0c632b8481a702e17fb54634229
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 53.1MB
        • SHA256 14fefdd18d733e8183a8934707149e6d39295b8bcdeba9da7971ac573afca3ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 53.1MB
        • SHA256 b4a13815802ccdc344ea01e7c8fac83f69d0d2ca48c3058dbbcf78e9c4d614ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 53.1MB
        • SHA256 904c630b34cd8ed6ba67d797076bd9a959dfd5ed5d3f1841b8a8818af5e3b5be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 53.1MB
        • SHA256 d8ecc0a83f888edb534624b4925de3aa28cf7f955ec2e9904cd99e6a47af95c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 53.1MB
        • SHA256 538a0ddc694da5e170760dbfc40514d5b37e8602c42158a11a0831b0350d8c12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 53.1MB
        • SHA256 3a2703011ea18fca57e38e5f081842b63904a2190539ac7ab11158de6d3fc3ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 53.1MB
        • SHA256 cd9da06b8bef0654292ffe7bcb3f813b106f21e828fe03fce375ef1c66eae01e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 53.1MB
        • SHA256 718171e758f33376f3e0f104abc7623fe9697fb7b90ffd09cb01fdec6e567ac3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 53.1MB
        • SHA256 18c598f41cd028e6d000936443f9aa0c48245f3a012f60aa5c1533bbdb77dd69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 53.1MB
        • SHA256 de5bf0bfd6692d1131ad2e1e703951fa47d6e04bc70098ee58a1388c43d55a97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 53.1MB
        • SHA256 18de008a3003b1e54b9b79941c09d4da7842310aa76c1533ef2eec5eedf185c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 53.2MB
        • SHA256 b0d0f2bc523e221f85f1c1ec79a8c59d038359960be31ed83bb26b85e52e7d01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 53.1MB
        • SHA256 09e78d710b9609f5a783c5ae5bd80753e7d6e8baedc2d5d097c32e8fb1780275
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 53.4MB
        • SHA256 3faafc9d577ae2c7be5d6c981057eb94a3019aa253cc320df99fdbea22ef753a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 53.2MB
        • SHA256 cfe5ed6886d4feab093aba1a309c4bfac55feff3500052cd7df022445934b96a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 53.4MB
        • SHA256 7e560db74abb8986907ff29dc36eff1fb2a5b1a0ad3f933afde77eed92398fd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 53.6MB
        • SHA256 b51ecb7bc1b27ff89aeadccf1740fd3cb3ae8d8978e4a56c2f5e8da4b7870389
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 53.3MB
        • SHA256 bee3c3eba5544a5e24c1bc1380668dbaa4e207388984b3b1a5cde2d034d8e7db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 53.1MB
        • SHA256 aa7a2e54e47c8091da997ae46c73bf1344556d0acb597186dc6035e5ab905ac8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 53.1MB
        • SHA256 36bc6eaf55317f8dc4eea015f3271b5fca55da19781704bda591e9d3f7efa7d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 53.1MB
        • SHA256 12ecf3e97f75c07588bc145b2e8d517eb2db282ede4910b567798b14b85c51c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 34.1MB
        • SHA256 a8442867eac2440996b4c4a7bf4d6c86889fc42ef9abe7011ef2c450cd5cb13d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 24.9MB
        • SHA256 e79782db971168e63304e8f456c5db4136b0191c44718eaa0c0f58f726aee3cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 25.6MB
        • SHA256 5da63f1ab75ac772318ea47c43ff36b6096e0ada3facff6fcef9718a9c853d19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 26.6MB
        • SHA256 1ac6c64f44974fb75fe094d1ce7728304fa62ace4fca7faf6920662b1fa330db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 13.4MB
        • SHA256 f2fdd2235d7676152f65712c3d783d26c113b9f111e027b550cd538b8eb59c3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 26.6MB
        • SHA256 562e8d8081df56bae6996f39037bc56e23a5786550f1409ff9be169f3f9bd708
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download