Overview

overview

8

Static

static

3

2026-08-03...as.exe

windows10-2004-x64

8

2026-08-03...as.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    25s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 11:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_5a97e434a5f35ddb7807e57de7b56732_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
  • Size 25.7MB
  • Sample260804-nzlaqsvyes
  • SHA256 597d3a3400da008e2a600fdacecfb78551889e52112b60db7374cefaeedc28d5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_5a97e434a5f35ddb7807e57de7b56732_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_5a97e434a5f35ddb7807e57de7b56732_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5052
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_5a97e434a5f35ddb7807e57de7b56732_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_5a97e434a5f35ddb7807e57de7b56732_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3452

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 25.7MB
        • SHA256 597d3a3400da008e2a600fdacecfb78551889e52112b60db7374cefaeedc28d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 25.7MB
        • SHA256 03a68e972481747a96fb8645512132ba211116414e0d65358ef73001f032e4db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 55.5MB
        • SHA256 70aee98ab8c87c40f6911b97b063009daba110b27165a65020fb43c1cb5a8ac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 51.8MB
        • SHA256 97c862dc1f3f46b51b6803cd2d1cbd643847375629af4ba628813945db64a9e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 55.8MB
        • SHA256 991a2cc401ba993b89aa2012ffd30e38dba3a3315e6ba5c7d6eb466184f83a38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 27.8MB
        • SHA256 a5f6aca3a211493bbc4a8f5e8cf08c409b8304b24201e94047498a31918f0e5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 51.5MB
        • SHA256 7618b21e378b1990f6bd757c130b3784a3bc8bc57ea1e6aab3b08be8ff03d45c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 51.4MB
        • SHA256 0239d55df90f7c74c681bcd96fe226fdfe0a18560cab7e96efe3e013d3a366c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 51.2MB
        • SHA256 b6fd06a424a22ca6cc345dc1c8f61bfccace656db06a79691be78b6d4ce8b7a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 52.5MB
        • SHA256 a8de0ba5b5de3316652b13e4bdbbe34bb7bac0b632d1e636267b84d24f58a240
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 48.9MB
        • SHA256 0e6c792d98b2582dafbb22d060bd4ff7104227fdca7a89564f83173b39e5bd56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 47.6MB
        • SHA256 ed4929ddce3dc46393ce5d8da0e4de74db01d4c80f4a1f09adf992e0718ca231
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 46.4MB
        • SHA256 189aa53511962325af871f2a37d4ebd93a25a162dc703aa46d5fba501eb25c0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 45.2MB
        • SHA256 b5145adac3ec3e88794c5185fca2b38e6130c477272d6205ee95274343b8bd5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 45.1MB
        • SHA256 004ca7dc75ced9c5428fd27f23eebd04a809445b5ef1ec3147ed42a942f3fa24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 44.7MB
        • SHA256 b67c75b5831eeb2a86e4a85ce00b01dbbcdf1df24fa5da00f1b5ab1323ce7996
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 44.5MB
        • SHA256 e5b1f05fbb76600df89c5f7c87d8533e02f71356fff652d4c4136ccf598df479
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 44.5MB
        • SHA256 b7a6fda3185662d5e6e26a13b98ab4f6ce6b58af592b705800a871586a1bfffb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 44.1MB
        • SHA256 822c535e25ea0e7cf93002ab8ce6aee219fd54b54f00168da40a933d9401e9d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 44.0MB
        • SHA256 099347de67eb0f99f29f8d8ec46f2dda197c4d491f6ccda2b0232bad5c448162
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 43.4MB
        • SHA256 d0deaa2c6782b3cdc64ead9890b7c1eb634d142c39c60f8d2aa481ed036f77bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 43.8MB
        • SHA256 ad335b3916de85c2427a1f63a081938ecae7509dc9e4dcb0de17df19c3d667a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 43.5MB
        • SHA256 7b34b94bbcd4cb49e3ff430985b053e7dd4cad483a64723f3c3139f821d9486c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 43.3MB
        • SHA256 3365debd0fe559011200afd20e0fc484a1880dbd690e37495185253faf919066
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 43.1MB
        • SHA256 9c443cb01b98e28282587fe9de7c56dfbf9c0edd53fb5e91a482343e5ac864b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 43.0MB
        • SHA256 f6688f494b72759c9dafa407deaac7b530b4655da16a9bab704994cd8fa4077e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 42.9MB
        • SHA256 fd468a4432ec7ea7d6599c6c8b7edfec6919e927bd221bca78be4225ed063fc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 42.6MB
        • SHA256 289186ff8f5d633e6fe13154cf44a8c3d8962e7df9d8187775e2937e50651e2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 39.2MB
        • SHA256 c623ecb9119b4980fb10031e7274d335800f332266fd3e23ff1bf1d4fc62669a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 42.4MB
        • SHA256 b79a5b65604526323b90f5e68b439bc7dd5b0093865fdc2fe98228f3aaaead75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 42.2MB
        • SHA256 22e716cd51dbe1f566d25013386af2f2e7c81a0f922557830c37de589cf772a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 38.8MB
        • SHA256 843ce4169c5c418b1daa33872292fbc0d1903faaa6566a91690d85083865aadc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 42.0MB
        • SHA256 c6764d0082a0c685a5bcdfd3a20f528464d9fecbfa74749acce59eb24fd20167
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 41.9MB
        • SHA256 d0def54c5681b6e3b45abf74517cb792739069ed957460ada056606c74588f36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 41.7MB
        • SHA256 affbd7992f27862b02015af3542e393493a1a2d5685ef466f76ff1547f11b184
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 41.4MB
        • SHA256 d2a8e11c0d6360d610025e01a6a7ea0d103ed95b38c80405f5d3d3bc267f8345
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 41.2MB
        • SHA256 a383b1f7ca5ebd910879d50395597154b750f75a909cbf13ac24c42006561931
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 41.1MB
        • SHA256 859e509e85c3a29914a52a2fe24a26e2105fd6e14363e67c71b8bda1fd6d3782
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 40.5MB
        • SHA256 0a519f69bb40d8276be608baf69ec7320e33672c8f865f9b9433459a5a9a0a8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 38.9MB
        • SHA256 d321cdda5e1fd2856ff9843aa4544dbcdf0d25df4c507ce1807f6ed37f423cbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 38.5MB
        • SHA256 9d8f1d4ac964781571fab850244abb3e96b2f61613e23476f5e525c35f1ab157
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 34.2MB
        • SHA256 2e415d70c43d992cde5851f9e014c60cc7d212ba4ea0efee6cf615e5bbe5c8f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 38.1MB
        • SHA256 f966080f6d1ef40406cd084ac40cc890b15d5e5af60b603aa4e9c455ed4d40f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 34.0MB
        • SHA256 06d8957e62e2d59f68ea292f67f5ff71d572dad878e41c2f7c2f58166719791f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 51.5MB
        • SHA256 643bc31092c61f2805f8ff9d6ea529e1564f01c9fba4e547de859ee274df20ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 51.5MB
        • SHA256 6355cde95718687d264939fde3ecf307acc5c37b48b56e50c4530b3a793b78e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 51.5MB
        • SHA256 9a8bbd5ad1930d9bebf9306d050307effa43d22374dbb563242eb831c1bd5dc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 51.5MB
        • SHA256 837f275b18939f00e69647f5eb2f68fbc0ebc3405f3379113eb607d8a39e1426
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download