Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 18:58

General

  • Target
    2026-08-04_a2d7f82273b6c04bc5af37ca2fe94c33_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader_vidar.exe
  • Size 4.2MB
  • Sample260804-xmlkeav1bw
  • SHA256 97e1b31750a333b959a52076d8a7cb984072ba23a66b118770db75adbafca3fd
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_a2d7f82273b6c04bc5af37ca2fe94c33_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_a2d7f82273b6c04bc5af37ca2fe94c33_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4592
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_a2d7f82273b6c04bc5af37ca2fe94c33_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_a2d7f82273b6c04bc5af37ca2fe94c33_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5684

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 4.9MB
        • SHA256 b5ebf94b2f74bc261f8b0784e0d03853d2d2427e2a3de44a092779c78941cef0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 4.2MB
        • SHA256 a46ab6ae23f19168d5154cf03cd09cd13dcbf7f2c7260584cfc6eb7ec0bf2107
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 8.7MB
        • SHA256 542ddaa0f149f0c9d765ba4365c4b792fd1e23b8de68a13cf91a3a10c8139896
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 8.5MB
        • SHA256 ab6a1c44b5ef2ee993e5f6163a36ae12e256cd16832a8d2dbf2daf9c4087f6e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 8.8MB
        • SHA256 7cc8f9f0a4601f3bcd950dfe5e20730e537339af75a6c53f292b88d4ad5e9d51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 27.7MB
        • SHA256 4cbc249f2235131b1d8c4867cc856da46d59c5f3cbc17a865778c273513068d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 6.4MB
        • SHA256 0ac5fe8615a539be8be86e81191664a3542fd61a60ec17ea533ba0406eb3c4f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 8.5MB
        • SHA256 2769311eeaba72fb698986357bde7ba3aa70ca4507bb4cda0c5636d41468f302
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 14.5MB
        • SHA256 5316b631fac9180ca63c4bef6cd28dbc77f3762da996d38192662a3678c950ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 10.2MB
        • SHA256 460836d09252d6af8ee41302d0a85f234cddbb29201798ee64c916e5ea533360
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 11.9MB
        • SHA256 04c94ea6a52d63b85f5ec8e7ab81b5a59f3b807ad304c556b8cbb12c15a088be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 10.7MB
        • SHA256 91d9affed989af31fe310cfb666126ad8aca1f2e76d0f553d2603d9b44c4719c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 10.1MB
        • SHA256 38f76735cade76ebfe9e49acde72a3e7ac57894fb7be26b957346076f454ac1c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 10.3MB
        • SHA256 0da36a7a1dfbc8b119fe31faaf9ef3bb7eff9be29b97b7805f121461495f6069
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 11.5MB
        • SHA256 b793a22f7cdcbdc5d0c8dad0722bf74a3f1d2bf8a101f3ce1a6e1cefa3225ebd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 9.9MB
        • SHA256 d293bc078e08fba10b441d846dd4e34c0da26f86c45a8a6e815e02bd834cfed9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 8.5MB
        • SHA256 18df344dd8637a0f2cb76b62a8469d13a7fc310d748d146265771ab575a3c477
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 8.5MB
        • SHA256 131e8d300a8c75ae0be700cac764bc2a6072d8ba7f611121f43aabc4af613901
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 8.5MB
        • SHA256 ff65c3a239dcca9422165a46895318859d162ce598bf76920556387cae86107b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 4.3MB
        • SHA256 0ef0391a95c4e3801cc4abe11ecff3036102e567b376005470bb978e9a739880
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 8.5MB
        • SHA256 2fa072989ebc5cfbda14841b85aa62487d15fc892ba15bfc710575c748a1dc84
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 8.5MB
        • SHA256 48fc561722e5b0bd82ad27d08ce3f88b75676f625dbe15c11a9afd45c65cdfa3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 8.5MB
        • SHA256 d71c9ce2e2d505c845b48a84170ce4af0e315d2a235c731c62b628dd33f8d404
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 8.7MB
        • SHA256 31cdaf9bb4027806737b7e8004690fe6453a190da0e827db8711b3cef2d68c90
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 8.5MB
        • SHA256 5a8f640fb0db915a1a62af88747ee0c71970aec5172d4edb04311866ddd5826d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 8.5MB
        • SHA256 8c8fe28c2fac6d975675a5ffb5e0d873ef0619923bfc6d5e0d37f3d3c656dd02
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 8.6MB
        • SHA256 04a26e095844bd8b9e5ff62a2a335215d79c5f06e450b24a5003860953bb7642
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 8.5MB
        • SHA256 c176074b155488d8c24517826f944678ab72fd8c6ce8cacef17b31d9643bd406
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 8.5MB
        • SHA256 7970a4c44a6608fcab0d48683b0107a9fce4375202ba0436a0e620799ec84066
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 8.6MB
        • SHA256 7e52cb8187dfa00c0f7ecb9582ad1340f6bcad706a248b5fe90f80b10b77e8ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 8.7MB
        • SHA256 3987be3a4264b9c2e3380b141a8b9692b9a3191ab87668e8efc51fcf541cb3d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 8.9MB
        • SHA256 88a7e02f1790c08719e9e9f21bd538e14c80fbc2103f5174321dac0733b694fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 8.5MB
        • SHA256 b2e265e79e98b0c14cab55da8de1adee945a777f7e71f11975350947fd37196d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 8.5MB
        • SHA256 fca2c14f4c8ddcdf00083a6051b557c383fed529d934e01487074fe6322a5147
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 8.5MB
        • SHA256 612947b711c73b8765aee9a3d7ccd7accf119f16e5a9fe6b03875c8299538a30
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 8.5MB
        • SHA256 8ac05a3686152ac2e94ccba05414ace82e7cdb44a38e0ca1c968898b35993f28
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 8.5MB
        • SHA256 9151f848ea1be0c24f399f4997ae2f78c809c1f8df233d6863bae1ddda48a905
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 8.5MB
        • SHA256 51eae0ce13147728a96bd714ad34d83d89df011941eee849ea09324ec52746aa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 8.5MB
        • SHA256 8ad143879668f7a154b3d4e68eb02ce573475d4785698649e06ce62d59efc579
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 8.5MB
        • SHA256 b85b801df268e1d2c5e7dda3aefcbe9fbfe58c03b8681cb817083720dad4c3f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 8.5MB
        • SHA256 fb65357d86d14f3cea835399c348540fa6fdd5d46a3ad7a63fee59be969bc2fc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 8.5MB
        • SHA256 a6225ab2f33d54d15c380ef9940c328cb2eda4c6396f2e38247fa5f78802bf3d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 8.5MB
        • SHA256 37e6b8553e194ffeeca35a5c1ed1559c7f749d3befb21f0a3ff31a196c765839
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 8.5MB
        • SHA256 5cf3d3465469fbd4416871a7b672cba8e845f4dbac56121fcf265aee14bc5e46
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 8.5MB
        • SHA256 9d5b4c37418746a1564b12c589a50194b7390600f8f47cf620371cc9cd4e850b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 8.5MB
        • SHA256 366c96369b89041d07d5f12984575d399c714068df8e3a9d87a47c1c2404d26a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 8.5MB
        • SHA256 ff1950d9b965a60d2a9a8e654d89450179c02c0beb5b74fea7e084abed02c8d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 8.5MB
        • SHA256 f0ef6174912e6346c39a487c47c4755f667e913fb605338f63a9d7929f065841
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 8.5MB
        • SHA256 4a899fc5673837626901ed03c3746439c2d7d518d17fee86f526cba28eee89cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 8.5MB
        • SHA256 d24c20eeba574fa8a9044b09c0dd28c4058121a2b02e1f684d7850b2e269026c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 8.5MB
        • SHA256 639d6be0d727509d44f6f5af3d1d066cdf55781a03302320e02da4b84087741f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 8.5MB
        • SHA256 55e1046108223503a0b79bb74e511295cd290d27a0b49b1eea699ea47754bee7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 8.5MB
        • SHA256 539438e7317d4fa9966b19feb06a88da1d7581fea8771ab7b89d867e6cd2ecfb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 8.5MB
        • SHA256 a654d70fc4bc3ff6237aecfc6abbd8131b1ffd1b1fcac9e92f3e59fefbbe0234
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 8.5MB
        • SHA256 5bdd9b96a9cb10eb5f82b17d82a639031dac490cf89c3daa53f7db586e163deb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 8.5MB
        • SHA256 0ef2266794fdb17d4da376cbc91888739e1ab255a169f46d02a337f327f01d73
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 8.5MB
        • SHA256 6dedf60a3fd0dcab2a49e3e6f4fbccdfcc0d92877a11a218597864a6b758ddc4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 8.5MB
        • SHA256 6025b2c39d3a6f06c4034684382ff88668b754e3165373e9494cd6d903404d27
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 8.5MB
        • SHA256 88d90ee8e9446a783fbc3bbe0cc1d8e947c7851c3e091b8da3c6ae55299126db
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 8.6MB
        • SHA256 0554f02cb0a1727a2c56a6bf6259d30792e748164094f7b0ab0df3251e13065f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 8.5MB
        • SHA256 1257591957e020b7fb1ed8b1ed5ae522740031003788f53ac746f6b9f3fb1929
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 8.5MB
        • SHA256 6275ae28d872dd440234cc0952df81e003c39b67f4597c367e21a8558e673e44
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 8.5MB
        • SHA256 245057b95874ddf952e0b7c32b0d69962fe086d5b91fce50cd27790223b3b29a
        • MD5 SHA1 SHA512 SSDEEP TLSH