Overview

overview

8

Static

static

3

2026-08-03...as.exe

windows10-2004-x64

8

2026-08-03...as.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    43s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 08:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_f4ca452f2ff60202023de91ab5a7198f_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
  • Size 26.4MB
  • Sample260804-kwe3rswdkf
  • SHA256 03ad440dcef1956e19fb52edddda26feb39b64a3a41dc084685a85665b85c4f7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_f4ca452f2ff60202023de91ab5a7198f_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_f4ca452f2ff60202023de91ab5a7198f_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1276
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_f4ca452f2ff60202023de91ab5a7198f_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_f4ca452f2ff60202023de91ab5a7198f_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5632

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 26.6MB
        • SHA256 a09f032cd0cb6329479f3080f48edfb8ed9e170eaf5dca4d450896793837da31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 26.4MB
        • SHA256 3ec8501cc1691105acf1aba8c1167283d779a5725f398354ce5cffd8605d3300
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 56.8MB
        • SHA256 a35587a4f29ad03f42da365f1eb258d3df78f2a611b23827afcea0930ea8d5fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 53.1MB
        • SHA256 0cb285dc09a216a4c41e7bde24c228b1a20e124431b399fbfe9c0bec9f903ac0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 76.2MB
        • SHA256 63a0ea49884d175be6db655dc84e50abac166cb49c5da41092d002754adebb29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 28.5MB
        • SHA256 a524fb7a3d5053e0bdee4414fe50c0df04d42b8d4c13176eed9ea23933cdeaac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 52.8MB
        • SHA256 d2f03f831dc067db635bfb76edf53ac8870ded192964f7ffadfe4a634f7fef4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 58.8MB
        • SHA256 ccfbb05a6b3eb702debec3444419de8b1b792f1eb5ba4243e3da3f22b09dcf4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 54.4MB
        • SHA256 4b935096de339c7cfe305913bdb1457d8a0c280bdaddb744e77372b8523beb08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 56.2MB
        • SHA256 580f16e342221e88d0854edc953812d2d1740d8a24fdd7b0fe7e7291aeccb6c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 55.0MB
        • SHA256 70587c7fffd2027f43b954c26e716c45cc7e05d3300fed019edf6de0c71b3286
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 54.4MB
        • SHA256 28e7c2828765c3e3db9d7e4fce54527ca96a7b75834410224cea3d4c34b44778
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 54.6MB
        • SHA256 826cc3717f28359070b62c8f3e9437eeed81a35d1dadc808f8975c53c72b842b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 55.8MB
        • SHA256 3e3258fdf0ca46989145691e55b6ef09ba9611b26355946e62bdec594afb6413
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 54.1MB
        • SHA256 7c01b8a84838d4018d873ae99ee5b92116ad02aadccf7f4e0276611f3092daa6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 52.7MB
        • SHA256 f68366cdcbd7b240dd7ab8f4d50a710a355f2b788c2240f4319b501205a9e314
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 52.7MB
        • SHA256 f68ec9c77df95d2da93dfcb9c32971f8d6ee1e0e04c0f61e6f258c2371b39133
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 52.7MB
        • SHA256 36b1ab9a09e66030edbcf3ffd930ecd7d2fc6941b4b0699cd5ce0c991aac49bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 52.8MB
        • SHA256 125ee9a5e8bb0a3bbaa2bab61816be2ff836bf7c06736015a3684383ed32e8ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 52.7MB
        • SHA256 147df5e9ca2b71e1b73ba60ad0f88b0cdd064bde62812c60e14a0dba7a77f78c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 53.0MB
        • SHA256 442ecc368028c3a4456373855251ef29aecc30fc9373e0773080e3ff33c32e13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 52.7MB
        • SHA256 a3c49a915b757630cb15294f504700e43326a8ea7bdd8b5b96fc3d5d8fa89905
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 52.9MB
        • SHA256 ef3eee9b78dbad8aa9b5c9eb7442341614f084fee17b6ca8841d4043cea10c79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 52.7MB
        • SHA256 103fd35ced082fe4a0010a23df9d654afc315c11c9b4f376a9a3d5d6674e0f7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 53.0MB
        • SHA256 8fb536c3e3d1c44a4abd232daf8e28858eaffd1ccdecc803c7992a2b171da6cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 52.7MB
        • SHA256 e8492a49068ece25372dfd5b33efad5a4c0fbd0e0b80691ee6b270d4589d0010
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 52.7MB
        • SHA256 519d2430573fdcaf5402b4f10a030d5439b1a0e51bcc45c512b883513019260f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 52.7MB
        • SHA256 e889524ad7260275033a71eb6c140492085e2624f8995de26c1bca3ffe0ee79e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.4MB
        • SHA256 9fd826fba654450b3110fa0c94858988b7cd9de1d429d48c9a115291a94894dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 24.9MB
        • SHA256 79f1fe553c5f48e51ea81cbba29467e49a84d9ffba3fa93ecd360eaa53f72e28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 25.7MB
        • SHA256 7e7795a1c63019ce4470f71ca159557d9af9a909bd66af9ba639366c83564986
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 23.0MB
        • SHA256 df771f7e25dd712e73163ab2a33ea9a43fccfb98a3bdadd783c19976be1435fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.6MB
        • SHA256 efc77b4a71304201532ed35dbabb9f53c7666df78eeff27b01b7b6b6ba3d3766
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 24.2MB
        • SHA256 6d8721a6529a47ca045a8934453f7c22722a672ed25498eb95ebf5abc4eac76f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 23.8MB
        • SHA256 a4b370e7fa79d161f2df25c0db0ed24ae24e0da73dfb783469e88c83c4a6ccec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 23.2MB
        • SHA256 558d85ce31ab1d3a3e8fee9c14c2e0e621f5b0b64cb7b5e75bd43d1f56da0fc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 23.1MB
        • SHA256 6d87e18382d14d384905eab966e411df17f7f95d619509737cbcb846e56d0beb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.6MB
        • SHA256 461f73869319fce4a136a5b878c2a6b1eb9f5a857e515b6328a13daa671b982f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 16.6MB
        • SHA256 66e27191eb5b73daca3ba4475699c2f71783693e42fa70016a09ac72c61a3e61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 21.9MB
        • SHA256 327393c94e996d8b3448db68ae39a445fef0e0b8ce93f28ecfc85d7a92060a41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 21.9MB
        • SHA256 6c541adf019af19c6b9233ccf4ca3982d20ac509f56cf80f78494b121cf8d8cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 21.5MB
        • SHA256 b756f2898a4e5a5b3b2cfd3823c46a1f7d81a1430cf837184e02d5553066a7c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 20.8MB
        • SHA256 0b08cc2c12f32a05e99056cc994c85a28b1a07aa4cda57b94a835042daa3e15c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 52.9MB
        • SHA256 aaadd5db681be54d9e93d256bcbf54181b84aa79ce5e2eb07b6782b8351e0de6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 52.8MB
        • SHA256 26b3cc5574b1fedd0a42853fb224fe71bf6b9bc61a47b7162596be2a49032608
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 52.8MB
        • SHA256 2e90139d9c2dc0a03e030d8630de1834c863b22d2626829d21a32d28037fb097
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 52.8MB
        • SHA256 3c44d595069d3736f697506fa847add6758c25dd04a2514d5cec3ce73acde1c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download