Overview

overview

8

Static

static

3

2026-08-03...as.exe

windows10-2004-x64

8

2026-08-03...as.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    117s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 11:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_5a97e434a5f35ddb7807e57de7b56732_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
  • Size 25.7MB
  • Sample260804-nzlaqsvyes
  • SHA256 597d3a3400da008e2a600fdacecfb78551889e52112b60db7374cefaeedc28d5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_5a97e434a5f35ddb7807e57de7b56732_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_5a97e434a5f35ddb7807e57de7b56732_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3936
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_5a97e434a5f35ddb7807e57de7b56732_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_5a97e434a5f35ddb7807e57de7b56732_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1996

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 26.4MB
        • SHA256 c4fd0f7b964141a518705ff341cd715298b2c4e27ef9331a137694084f7fd539
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 29.8MB
        • SHA256 fcc8fb46ff29bf319f4d2d93856a79bcc1b0dd648c671397bbfc804a56c3e4b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 49.2MB
        • SHA256 e222a7150ada5ec3a2b48acd40b72cf6a793b1496eb748dfe11781494a11eafe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 57.5MB
        • SHA256 78e7e8ce7bb757663d7d5f0fc950762b17e5dce3d80c4922240687737361d77e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 53.1MB
        • SHA256 4d9a31d3a93dfa1cf9fa4a61473f3303ee7b7327400cb744d87a4334184dff29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 54.9MB
        • SHA256 e90c5ddf2658ee1202dc83c8b5bfe9cbaf3cc8b03b1bba3f3b5764485278b251
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 53.0MB
        • SHA256 53cbe7358b7a80facf1be119ce70a338df41512a70a8f88b5ecea93bbe8afffe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 53.3MB
        • SHA256 5d3ab94d160d857f2e243d0721f2597943939a10f9aa0d0e9dfbdf5577594d0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 54.5MB
        • SHA256 116a0233aa04430dbbc152c76215ed74d0a4218087ae3aa4a7516db8c0665711
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 52.8MB
        • SHA256 76de131b8665e49e81ddcbbba83e012ae91f8003150d58f17140a7182e7605c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 51.4MB
        • SHA256 fae5488d5dc9a6c5e7a0dc4cb67f805649175e30247b85c5bfe56463ad9bdeec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 51.4MB
        • SHA256 cae86eabdb2fdbac77fa28277c064d75139a5af2e8dacb7cd9f7f2bc45c702fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 51.4MB
        • SHA256 3376035e5d621e1e978b9d3f453986e9cf753c8bcfbe2afd4bef3856c05858ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 50.9MB
        • SHA256 bfcccf08877e005a77ac872b9d4b0fd3baf934e78f6bd1f72bdab028f6763c95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 43.0MB
        • SHA256 f6688f494b72759c9dafa407deaac7b530b4655da16a9bab704994cd8fa4077e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 44.2MB
        • SHA256 1e53cee7d819852dfcc3fdf680796967e7b106ae85f55c0535c9902b73325996
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 36.0MB
        • SHA256 2ee2dd432b9c221904c4eb7d179d70e89a8f825167a85f794c8aae3cae059fe9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 37.4MB
        • SHA256 7a98033e1ac66694abfa16a174fdff3bf074daa217d82cf20f3685a44775096a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 29.5MB
        • SHA256 0c5add7a656b981047f89e3ca4c7f292a800ced452ac81e6e14981f55f02d030
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 29.4MB
        • SHA256 d3e7cbd70bc7d2a58ce109e98442a47aad131d433e2c24682f0e57f1ae801b99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 26.9MB
        • SHA256 9e375fac96c68dd35bc6b4d0c33a533b8e81fa06cb5585cbef40294f5e37b159
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 27.4MB
        • SHA256 862d49bb850cbb459d88dca1c867e8fcad9f50e6aa599deba994400d2a7d9158
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 28.2MB
        • SHA256 6d65a95c09caf10d2f068da71be7fec682956e60443471ea05b8a648d892e628
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 28.0MB
        • SHA256 6dd26b214b88889b23c309d154478b5c1f699d0dca69b2d379c81e4a0a99de79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 26.5MB
        • SHA256 cb82674c25d058f4af376895fa4296fa42d4ea2a45ab3aee369cf9e96b1e7367
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 26.4MB
        • SHA256 7c5b90c6a7b3bf9ddc8e472ea6721be3d2ab5ad9fdc6558ae938eb242d88ecf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 25.8MB
        • SHA256 9b7008d89f54bfef583e45afb8d8dae3bdcdc91b242374a79e1aa734a6f285b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 24.8MB
        • SHA256 9cbb9f97fd880c885be3f357ba8ecf9b48f0a6fb23ff1a273d1780324e6bccb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.9MB
        • SHA256 2bfe12544c168351750001c8f9188e8378e5b3bbc2360a1b4c350a77f38953c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 25.0MB
        • SHA256 73b091f9ceaedeedbca5f428c95b32e9c054acaaca9279ec885196824f0d4b20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 23.5MB
        • SHA256 21c133d30e6ee605d6e81227c5bfb03c36f974f15cb8796562b67c52f3d1c42f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 24.7MB
        • SHA256 c49ccb3f0c18315cc7664a1e45cbdf49d4dc5c1a5c4e663f826efe297dbf9575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 24.4MB
        • SHA256 090c3d372aec3f836e02c6f14c0aafd892de1f8529c0400b4b3d2f4aa5bbb4c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 23.6MB
        • SHA256 5bf98d60ddc98851255fb52e1a4111ae5f328ef327b8d4054fc59472826ad3f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 23.7MB
        • SHA256 754abeef0ddeb4a7ae46310af95bce0a51fe1a9b6966dfe0c975cee6e85c5ac2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 23.6MB
        • SHA256 84be57d1dd952729da9c4372c3dbc00ba25436f154903c8dd33bf80739393199
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 23.1MB
        • SHA256 6d87e18382d14d384905eab966e411df17f7f95d619509737cbcb846e56d0beb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 22.4MB
        • SHA256 7576a3c8cc171752c201f745900fdf4c3e0c8753d53cdf17b43f6749060c07c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 14.2MB
        • SHA256 1c35658b432e289f8c24b696109f531336c12c2d604142a89870797ee7047df7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 15.4MB
        • SHA256 da1328daebc33f8d6ace42acbfa92907d787836ef512d029c69db6018d754b72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 14.4MB
        • SHA256 dbb7dcf465c3e8d58eb3b2939e270977fd8e01e293a0b6c22915ca348dc2bf0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 14.2MB
        • SHA256 76d1a2a91604bab0fcac848854f131bc18bb8e247f29e41acffaeeadf10a7f01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 12.8MB
        • SHA256 9d16be0ae61fd0440e4c75a555a36a0b6d45d44af4d335062bad3d11cf775f04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 12.4MB
        • SHA256 4a31f486f059f58a522f8916a6cbd9261d54a7be2fb3155ded9f2fc0582d5c8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 51.5MB
        • SHA256 643bc31092c61f2805f8ff9d6ea529e1564f01c9fba4e547de859ee274df20ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 51.5MB
        • SHA256 6355cde95718687d264939fde3ecf307acc5c37b48b56e50c4530b3a793b78e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 51.5MB
        • SHA256 9a8bbd5ad1930d9bebf9306d050307effa43d22374dbb563242eb831c1bd5dc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 51.5MB
        • SHA256 837f275b18939f00e69647f5eb2f68fbc0ebc3405f3379113eb607d8a39e1426
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 25.7MB
        • SHA256 597d3a3400da008e2a600fdacecfb78551889e52112b60db7374cefaeedc28d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download