Overview

overview

8

Static

static

3

2026-08-07...er.exe

windows10-2004-x64

8

2026-08-07...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 01:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_16c4791073e97de194d404af0f0fcec4_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader.exe
  • Size 7.3MB
  • Sample260808-b9mv4afp4x
  • SHA256 a6879132e7fc88184206dd53e04a1b1baf72c53818909be2f0327c40e1ec0fb6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_16c4791073e97de194d404af0f0fcec4_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_16c4791073e97de194d404af0f0fcec4_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1452
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_16c4791073e97de194d404af0f0fcec4_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_16c4791073e97de194d404af0f0fcec4_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4920

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.0MB
        • SHA256 7154f096ad8bd98ad192fd73c41219e68dcaa91a35a971483cfc54e9ce777187
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 13.4MB
        • SHA256 cd97eb56314dac5a5f8894e4e90d9aa3ac6be24d30c90997c2b1e3e2868640c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 16.4MB
        • SHA256 c06873578458b002c56d55ed6135bbd895845c3ea5642bf37b9a2b954fef1995
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 18.1MB
        • SHA256 ac6dca46b65de396bd03415cd65410b4122a1b8daded154788b3c41b96199b1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 16.9MB
        • SHA256 426a78931dd38dcb8b7decb9c10f467860b80d38d1ac0db151846a38a1408fbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 9.2MB
        • SHA256 d48decf65e477684b2adc1750cf13b10ba2b4d71dc547fc29b0bba6189edb522
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 7.4MB
        • SHA256 1b9fb3373e601953cc9aa6dc1ffc3c17e6597a827389e57999804a8c9cd43b95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 7.4MB
        • SHA256 5acc6a669492a3b557795e9a517206921ae63bdc6f495f47e57c44bb169bd200
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 7.4MB
        • SHA256 57d2a986ce02181cef303e47c84c2bdbf55f0e880f690de53eba38dc99f10c42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 15.0MB
        • SHA256 7ce6d1ed18d73e864c90d54fb6358c6737e04e456e6213130052c4e69c99c9ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 14.7MB
        • SHA256 f9785fd38ac0b37f32bd162bfd027d70e14f884bad1e20a7b0ae9c5d34ce4ddb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 14.7MB
        • SHA256 5ba7495838aa7ed663de083b7f461982efb3374ffdd6ec0daf381ccd54508060
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 14.8MB
        • SHA256 fd920b2cced610e47cfd30e23eb56b4f39e8d04c085adb8122ff176023fe1a55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 14.7MB
        • SHA256 ec45405baab49696a5a7fd60e4f466bd40e4c3904e846880f8ad1d20cb959698
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 14.7MB
        • SHA256 b3555fdafcfd335a6fc1ed4192d9eac2ba2468e099f49e739d14db8cde26f95b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 14.8MB
        • SHA256 9e5b51341145600a1d4e9f44b07f1edc3c7bf516ae5f4ac7f63b72f5cdaab047
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 15.0MB
        • SHA256 e71d8e525d0d5de222509801d3f6d219a5525e38f6ab4f1eff6c1712da14fd64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 15.1MB
        • SHA256 26b3fddd446475342d59d8b5aa3bed135eaed02f4aa5979903da8a7a27a52ad4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 14.7MB
        • SHA256 0a15d9b366782c43c7214a98ab30e286cd714cc2314060822b914f409005ef92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 14.7MB
        • SHA256 48f4abc332803f3b41053c55abddcf6d4aa9d252c0b068aa9486558afc363853
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 14.7MB
        • SHA256 06365e52b536430a8bc97b92cec702b83d0c7d87b77edffdee6463990866b2b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 14.7MB
        • SHA256 6d6d2be7d6b908f42a69849c1c06d2d825a1239132a57bc74563b15b22f4651b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 14.7MB
        • SHA256 8c4016d6160682c0c6064872d482b075b5b3fd8158bc25466cf9b5304a1159d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 14.7MB
        • SHA256 c7c40ea8260961d5ea356a82cbb967f9381cc70fb40aaec9c08d92ad62f580ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 14.7MB
        • SHA256 f918ed00c6414db3dbdd5c57dd93bfb8096c7f31a3d992d4b0d105120dc64a38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 14.7MB
        • SHA256 1ea5cf893958e43a91ea697c998c91501f41c9fd6f7fe2fe6ac81217a713d656
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 14.7MB
        • SHA256 45b89d719da2881342bf1339251256a3ace68d85d238a99751c5e96b959bc8cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 14.7MB
        • SHA256 bfc6e7b10617ad8a85c26a980c035800356c0bb5f11f60a5543354a6d5e8eeda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 14.7MB
        • SHA256 fd466fac955551780e1f09d826cc49a39ba62c889235a1eeb0422e57bf290452
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 14.7MB
        • SHA256 9d170fe8ac39b9ea24dfdfbc844333d7760d42dd07b3af4a804901303ec25dc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 14.7MB
        • SHA256 63e16a11c98dc31383bc338d424fe5f272e0b73c0d5def6bda3c612aa0ff69be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 14.7MB
        • SHA256 49f3180e01b8db7291ed5d6210eccba3862f8b80c3ebad4d5733f64bc3157b95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 14.7MB
        • SHA256 7523227271dc42fbf830a5384305c86c18eed04b261e2a18256f736bdf89b174
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 14.7MB
        • SHA256 7d5fc6df7e973b741480be634cc450431410356c7b3c3c566a98f4f58d26f031
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 14.7MB
        • SHA256 1e45c3ee3c60d7427f4b3d8a372aff3e7347e007be42e8965d1ef1305692a2aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 14.7MB
        • SHA256 e58ca710145fe63eda780496fbea6ad46e5a638cd98301503b4e7a2fa6e6244a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 14.7MB
        • SHA256 733358c177addffa93eda525707e21603f22c07cdb6b6e701835299abb10b37b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 14.7MB
        • SHA256 aeaf7043527887e0d9bf1b10431562e89cc13c216b217a27e1389f251823edbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 14.7MB
        • SHA256 98ec3c78eaf85325e582b7044a32e9b20ff2c19181b5d68ecfc302b1954c1d22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 14.7MB
        • SHA256 7875fa542fd67b3065765d0831a66695aed3148886b719a4e73d69a128898351
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 14.7MB
        • SHA256 4fc2bc531df0e60b24493ff0ca9460487eff4ff7262f584af41d27933a4e48ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 14.7MB
        • SHA256 e3bf4aa9e09ebe1bdd8a321baf1216f7e97bd0af8bf70c36cf13dbd9eb149785
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 14.7MB
        • SHA256 73e52d8c99853d5b478ee6aaf73afee6d6ec851fb1f0a93279a4064a1795fdef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 14.7MB
        • SHA256 f435357ff83ae372af2d4b421c8503db61df7089b4fec4c1506ff63739615414
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 14.7MB
        • SHA256 0d6248d722632f696b04289a5d7f7aea290fbce299ec10cf2a87b01cac7f77f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 14.9MB
        • SHA256 d160b0b189c80468a5f7b48493912275b3a530faab2b154b237f67fd8d3e936b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 14.7MB
        • SHA256 11c79d602288c3cc32eeebce052f91e439d4e0dcf180189c4b594657ffa27c22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 14.7MB
        • SHA256 4fe58d5c64504850115b4ee311aba7e9e5c533b136d54593421e37028eafd85d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 14.7MB
        • SHA256 9d4cbe7c6037ab42bc0fda77b2ea1e3173115bf56d58f01c3767be4995af407f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 14.7MB
        • SHA256 16b607f245711ef5f533ad6e937680856812238c4a317aff54d24ff649921abe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 14.7MB
        • SHA256 aef6233585e1c052d5fd30ef6e1e61ce25faef8eab27aa26757090e3c62ff048
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 15.0MB
        • SHA256 734d3ccec69755272c0012103f4b05469def4e47558aca909cfafd5ff5c1f432
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 14.8MB
        • SHA256 a5d2438061563a9307094ec90eae4759329dd693ba4541b1ef2dacb13c604d34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 15.0MB
        • SHA256 fb99219f6663a6aee7789d0593e15b6889843a56273b84248b68f4caa40f0c97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 15.1MB
        • SHA256 c93bf1dabc6821e3001120af533d46b33f4a93645e8a5f173fd7a1b34cfa2594
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 14.7MB
        • SHA256 a91cfd1438f17c643eae38182a98c4512266aeb83c0748eca330e3c29c57f607
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 14.8MB
        • SHA256 61a2acc9007d6f9aade94d714cda7ba9ae8fe220819e317faa928b220cb98374
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 7.4MB
        • SHA256 0654a2c61346f36d28eee91d30d8c6eada0ac7e8a543133611b9f8789f9515a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 7.3MB
        • SHA256 a6879132e7fc88184206dd53e04a1b1baf72c53818909be2f0327c40e1ec0fb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download