Overview

overview

8

Static

static

3

2026-08-04...ar.exe

windows10-2004-x64

8

2026-08-04...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 18:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_a2d7f82273b6c04bc5af37ca2fe94c33_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader_vidar.exe
  • Size 4.2MB
  • Sample260804-xmlkeav1bw
  • SHA256 97e1b31750a333b959a52076d8a7cb984072ba23a66b118770db75adbafca3fd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_a2d7f82273b6c04bc5af37ca2fe94c33_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_a2d7f82273b6c04bc5af37ca2fe94c33_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2228
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_a2d7f82273b6c04bc5af37ca2fe94c33_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_a2d7f82273b6c04bc5af37ca2fe94c33_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4516

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 4.8MB
        • SHA256 6dc8d8ce007f16e0faee1f1a16a926dcf076ebe5cde8a695875dd2c81cea4004
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 5.2MB
        • SHA256 4746a820bad39948e8aef3cd8e6e5806a35bea1a3875489e1d2a65429e261b40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 8.5MB
        • SHA256 cc11da85b75eb029c7f335ad4b6e176fa74e3658a838e1f74338cc293fed89a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 4.3MB
        • SHA256 24cb99a1733f373cf841eb52b134265351959ceca005b722e13777488db02270
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 4.6MB
        • SHA256 7ea9d76c40ccb028e613a15861cb12ff3b90c75e5b05ac0b2fb8ab39f7b560bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 27.7MB
        • SHA256 4cbc249f2235131b1d8c4867cc856da46d59c5f3cbc17a865778c273513068d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 8.5MB
        • SHA256 2769311eeaba72fb698986357bde7ba3aa70ca4507bb4cda0c5636d41468f302
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 14.5MB
        • SHA256 5316b631fac9180ca63c4bef6cd28dbc77f3762da996d38192662a3678c950ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 10.2MB
        • SHA256 460836d09252d6af8ee41302d0a85f234cddbb29201798ee64c916e5ea533360
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 11.9MB
        • SHA256 04c94ea6a52d63b85f5ec8e7ab81b5a59f3b807ad304c556b8cbb12c15a088be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 6.5MB
        • SHA256 c1e2c3cd24c3d1c27a88e784b47ebb8e5cbd70f5d96bb38d4af416d4095cbd4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 10.1MB
        • SHA256 38f76735cade76ebfe9e49acde72a3e7ac57894fb7be26b957346076f454ac1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 10.3MB
        • SHA256 d77d135ae88d6af6b9e76caef3d0fd0e4ca28122e08ea3fe0f3f26f008feb0ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 11.5MB
        • SHA256 b793a22f7cdcbdc5d0c8dad0722bf74a3f1d2bf8a101f3ce1a6e1cefa3225ebd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 9.9MB
        • SHA256 d293bc078e08fba10b441d846dd4e34c0da26f86c45a8a6e815e02bd834cfed9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 8.5MB
        • SHA256 18df344dd8637a0f2cb76b62a8469d13a7fc310d748d146265771ab575a3c477
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 8.5MB
        • SHA256 131e8d300a8c75ae0be700cac764bc2a6072d8ba7f611121f43aabc4af613901
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 8.5MB
        • SHA256 ff65c3a239dcca9422165a46895318859d162ce598bf76920556387cae86107b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 8.5MB
        • SHA256 92c101ececf7ddcf3ac53e77e925a2419902118d2ffb955c58be8b8d35c315b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 8.5MB
        • SHA256 2fa072989ebc5cfbda14841b85aa62487d15fc892ba15bfc710575c748a1dc84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 8.5MB
        • SHA256 48fc561722e5b0bd82ad27d08ce3f88b75676f625dbe15c11a9afd45c65cdfa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 8.5MB
        • SHA256 d71c9ce2e2d505c845b48a84170ce4af0e315d2a235c731c62b628dd33f8d404
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 8.7MB
        • SHA256 31cdaf9bb4027806737b7e8004690fe6453a190da0e827db8711b3cef2d68c90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 4.2MB
        • SHA256 e52819c38ac8c90dce3adaac7a5bd7623c631ab1da974db8e626050f21da0feb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 8.5MB
        • SHA256 8c8fe28c2fac6d975675a5ffb5e0d873ef0619923bfc6d5e0d37f3d3c656dd02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 4.4MB
        • SHA256 bdf175482b54fa652b88608f181664b5d8dd39ffb32f0745cfa215491b53c37d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 8.5MB
        • SHA256 c176074b155488d8c24517826f944678ab72fd8c6ce8cacef17b31d9643bd406
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 8.5MB
        • SHA256 7970a4c44a6608fcab0d48683b0107a9fce4375202ba0436a0e620799ec84066
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 8.6MB
        • SHA256 7e52cb8187dfa00c0f7ecb9582ad1340f6bcad706a248b5fe90f80b10b77e8ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 8.7MB
        • SHA256 3987be3a4264b9c2e3380b141a8b9692b9a3191ab87668e8efc51fcf541cb3d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 8.9MB
        • SHA256 88a7e02f1790c08719e9e9f21bd538e14c80fbc2103f5174321dac0733b694fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 8.5MB
        • SHA256 b2e265e79e98b0c14cab55da8de1adee945a777f7e71f11975350947fd37196d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 8.5MB
        • SHA256 fca2c14f4c8ddcdf00083a6051b557c383fed529d934e01487074fe6322a5147
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 8.5MB
        • SHA256 612947b711c73b8765aee9a3d7ccd7accf119f16e5a9fe6b03875c8299538a30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 8.5MB
        • SHA256 8ac05a3686152ac2e94ccba05414ace82e7cdb44a38e0ca1c968898b35993f28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 8.5MB
        • SHA256 9151f848ea1be0c24f399f4997ae2f78c809c1f8df233d6863bae1ddda48a905
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 8.5MB
        • SHA256 51eae0ce13147728a96bd714ad34d83d89df011941eee849ea09324ec52746aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 8.5MB
        • SHA256 8ad143879668f7a154b3d4e68eb02ce573475d4785698649e06ce62d59efc579
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 8.5MB
        • SHA256 b85b801df268e1d2c5e7dda3aefcbe9fbfe58c03b8681cb817083720dad4c3f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 8.5MB
        • SHA256 fb65357d86d14f3cea835399c348540fa6fdd5d46a3ad7a63fee59be969bc2fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 8.5MB
        • SHA256 a6225ab2f33d54d15c380ef9940c328cb2eda4c6396f2e38247fa5f78802bf3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 8.5MB
        • SHA256 37e6b8553e194ffeeca35a5c1ed1559c7f749d3befb21f0a3ff31a196c765839
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 8.5MB
        • SHA256 5cf3d3465469fbd4416871a7b672cba8e845f4dbac56121fcf265aee14bc5e46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 8.5MB
        • SHA256 9d5b4c37418746a1564b12c589a50194b7390600f8f47cf620371cc9cd4e850b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 8.5MB
        • SHA256 366c96369b89041d07d5f12984575d399c714068df8e3a9d87a47c1c2404d26a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 8.5MB
        • SHA256 ff1950d9b965a60d2a9a8e654d89450179c02c0beb5b74fea7e084abed02c8d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 8.5MB
        • SHA256 f0ef6174912e6346c39a487c47c4755f667e913fb605338f63a9d7929f065841
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 8.5MB
        • SHA256 4a899fc5673837626901ed03c3746439c2d7d518d17fee86f526cba28eee89cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 8.5MB
        • SHA256 d24c20eeba574fa8a9044b09c0dd28c4058121a2b02e1f684d7850b2e269026c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 8.5MB
        • SHA256 639d6be0d727509d44f6f5af3d1d066cdf55781a03302320e02da4b84087741f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 8.5MB
        • SHA256 55e1046108223503a0b79bb74e511295cd290d27a0b49b1eea699ea47754bee7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 4.2MB
        • SHA256 57ee5f85ccaf561b2eeced3cbeca35777ac8f663fb3f31ee027775827a00f2fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 8.5MB
        • SHA256 a654d70fc4bc3ff6237aecfc6abbd8131b1ffd1b1fcac9e92f3e59fefbbe0234
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 8.5MB
        • SHA256 5bdd9b96a9cb10eb5f82b17d82a639031dac490cf89c3daa53f7db586e163deb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 8.5MB
        • SHA256 0ef2266794fdb17d4da376cbc91888739e1ab255a169f46d02a337f327f01d73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 8.5MB
        • SHA256 6dedf60a3fd0dcab2a49e3e6f4fbccdfcc0d92877a11a218597864a6b758ddc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 8.6MB
        • SHA256 0554f02cb0a1727a2c56a6bf6259d30792e748164094f7b0ab0df3251e13065f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 8.5MB
        • SHA256 1257591957e020b7fb1ed8b1ed5ae522740031003788f53ac746f6b9f3fb1929
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 8.5MB
        • SHA256 6275ae28d872dd440234cc0952df81e003c39b67f4597c367e21a8558e673e44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 8.5MB
        • SHA256 245057b95874ddf952e0b7c32b0d69962fe086d5b91fce50cd27790223b3b29a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 4.2MB
        • SHA256 97e1b31750a333b959a52076d8a7cb984072ba23a66b118770db75adbafca3fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download