Overview

overview

8

Static

static

3

2026-08-07...er.exe

windows10-2004-x64

8

2026-08-07...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 01:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_16c4791073e97de194d404af0f0fcec4_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader.exe
  • Size 7.3MB
  • Sample260808-b9mv4afp4x
  • SHA256 a6879132e7fc88184206dd53e04a1b1baf72c53818909be2f0327c40e1ec0fb6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_16c4791073e97de194d404af0f0fcec4_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_16c4791073e97de194d404af0f0fcec4_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3212
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_16c4791073e97de194d404af0f0fcec4_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_16c4791073e97de194d404af0f0fcec4_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5756

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 7.4MB
        • SHA256 9e8c2d13abba9cbb302e08c5fdf72d2f63b048a8a15b7f191700df661eecdd19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.0MB
        • SHA256 c40331e6dba2c83361335289537c85e3303eda1cf12d192f0f22bebbde88a805
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 14.7MB
        • SHA256 6014e6a861c0f3e68ce2c1ae7528b8d4341d18e311aabfca7f1862dbd9cf6941
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 18.8MB
        • SHA256 52e137bcdb87f5d0193b2c87ab20529749c29a7ab995f1e283251c8cc4a71968
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 15.0MB
        • SHA256 9fee76f1c7b1d371100b80f049ed70c7e122ab30b3e47a0fb6d2ea3063342848
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 38.2MB
        • SHA256 dbe81f0d5d1eae6596a248bf5899395a68aa60ecf5d92102b7ba66283234f4db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 9.5MB
        • SHA256 aaf23588797b91e1535278cc1f84d1d87427fbe267377a8672ce66f2bdd29103
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 14.8MB
        • SHA256 de0ac2c8ec91ad79336162891233dc94ce4a965a9ec3b0438aebab574fff82f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 20.7MB
        • SHA256 fd45e0b731ba3b6ba1b70d6df959d76e526471bf8458377af5eb955b5235548c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 16.4MB
        • SHA256 c06873578458b002c56d55ed6135bbd895845c3ea5642bf37b9a2b954fef1995
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 18.1MB
        • SHA256 ac6dca46b65de396bd03415cd65410b4122a1b8daded154788b3c41b96199b1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 16.9MB
        • SHA256 426a78931dd38dcb8b7decb9c10f467860b80d38d1ac0db151846a38a1408fbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 16.3MB
        • SHA256 a8db099610187a17c69d9bf7f6ec0d508b808d567c47b30cb7a0fecd3712cdd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 16.5MB
        • SHA256 9893c63648099f0d35161d453be43ada1e432aee426e09f69650ea6b870b9d58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 17.7MB
        • SHA256 fbd5f34dba6c4eb05488d0e29f5c30b71394007115b9151a765d291ebed883f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 16.1MB
        • SHA256 b3abc5544825d0fbd7d9b14933e78ec7a5c036aef55d545ab4e3101e6290bef5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 14.7MB
        • SHA256 8c6e6bcf6eeb495f04a6ab65b71869731fb8d8947355802b4ba49c77dda5d062
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 14.7MB
        • SHA256 ef253d606279ed5b1a4a2de6868373dc3ad34ece65d035dc6f8c878838a80f74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 14.7MB
        • SHA256 821480250d1eedc76946e45e417ef0fd2970c4ed194e34ca81c7f9071ee30bc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 14.7MB
        • SHA256 0de37daf18fdde9288e59f09d78618d04bec0dc86ec481f9dbe5553a8bfc3e22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 14.7MB
        • SHA256 14a701307cc3ddd3f839534f0d1cddd552fc7f007d54439d4a6d544712f026b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 14.7MB
        • SHA256 336dd5cdc88160aa915ab13674bb1364eca36587eff49250bad6d46f2b7881f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 14.7MB
        • SHA256 4ccc384574a6163e314b5c47cb68b548425f963c2ba9aa7324b6c0c23a5bb79c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 15.0MB
        • SHA256 7ce6d1ed18d73e864c90d54fb6358c6737e04e456e6213130052c4e69c99c9ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 14.7MB
        • SHA256 f9785fd38ac0b37f32bd162bfd027d70e14f884bad1e20a7b0ae9c5d34ce4ddb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 14.7MB
        • SHA256 5ba7495838aa7ed663de083b7f461982efb3374ffdd6ec0daf381ccd54508060
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 14.8MB
        • SHA256 fd920b2cced610e47cfd30e23eb56b4f39e8d04c085adb8122ff176023fe1a55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 14.7MB
        • SHA256 ec45405baab49696a5a7fd60e4f466bd40e4c3904e846880f8ad1d20cb959698
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 14.7MB
        • SHA256 b3555fdafcfd335a6fc1ed4192d9eac2ba2468e099f49e739d14db8cde26f95b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 14.8MB
        • SHA256 9e5b51341145600a1d4e9f44b07f1edc3c7bf516ae5f4ac7f63b72f5cdaab047
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 15.0MB
        • SHA256 e71d8e525d0d5de222509801d3f6d219a5525e38f6ab4f1eff6c1712da14fd64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 15.1MB
        • SHA256 26b3fddd446475342d59d8b5aa3bed135eaed02f4aa5979903da8a7a27a52ad4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 14.7MB
        • SHA256 0a15d9b366782c43c7214a98ab30e286cd714cc2314060822b914f409005ef92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 7.4MB
        • SHA256 76a00ceb5db159652fd5c55c46b474521b336ac428f35d183efcd80c775fcc62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 14.7MB
        • SHA256 6d6d2be7d6b908f42a69849c1c06d2d825a1239132a57bc74563b15b22f4651b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 14.7MB
        • SHA256 8c4016d6160682c0c6064872d482b075b5b3fd8158bc25466cf9b5304a1159d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 14.7MB
        • SHA256 c7c40ea8260961d5ea356a82cbb967f9381cc70fb40aaec9c08d92ad62f580ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 14.7MB
        • SHA256 f918ed00c6414db3dbdd5c57dd93bfb8096c7f31a3d992d4b0d105120dc64a38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 14.7MB
        • SHA256 a8fc2956745fc8a72e4707b371c9b252dea848a7057a2c5abca8fe5d44aabe32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 14.7MB
        • SHA256 1ea5cf893958e43a91ea697c998c91501f41c9fd6f7fe2fe6ac81217a713d656
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 14.7MB
        • SHA256 45b89d719da2881342bf1339251256a3ace68d85d238a99751c5e96b959bc8cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 14.7MB
        • SHA256 bfc6e7b10617ad8a85c26a980c035800356c0bb5f11f60a5543354a6d5e8eeda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 14.7MB
        • SHA256 fd466fac955551780e1f09d826cc49a39ba62c889235a1eeb0422e57bf290452
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 14.7MB
        • SHA256 9d170fe8ac39b9ea24dfdfbc844333d7760d42dd07b3af4a804901303ec25dc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 14.7MB
        • SHA256 63e16a11c98dc31383bc338d424fe5f272e0b73c0d5def6bda3c612aa0ff69be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 14.7MB
        • SHA256 49f3180e01b8db7291ed5d6210eccba3862f8b80c3ebad4d5733f64bc3157b95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 14.7MB
        • SHA256 7523227271dc42fbf830a5384305c86c18eed04b261e2a18256f736bdf89b174
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 14.7MB
        • SHA256 7d5fc6df7e973b741480be634cc450431410356c7b3c3c566a98f4f58d26f031
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 14.7MB
        • SHA256 1e45c3ee3c60d7427f4b3d8a372aff3e7347e007be42e8965d1ef1305692a2aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 14.7MB
        • SHA256 e58ca710145fe63eda780496fbea6ad46e5a638cd98301503b4e7a2fa6e6244a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 14.7MB
        • SHA256 733358c177addffa93eda525707e21603f22c07cdb6b6e701835299abb10b37b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 14.7MB
        • SHA256 aeaf7043527887e0d9bf1b10431562e89cc13c216b217a27e1389f251823edbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 14.7MB
        • SHA256 98ec3c78eaf85325e582b7044a32e9b20ff2c19181b5d68ecfc302b1954c1d22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 14.7MB
        • SHA256 7170b10e5d52d11b97b93640b2df4309842fac832d3306e91c27c70170e9ca04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 14.7MB
        • SHA256 7875fa542fd67b3065765d0831a66695aed3148886b719a4e73d69a128898351
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 14.7MB
        • SHA256 4fc2bc531df0e60b24493ff0ca9460487eff4ff7262f584af41d27933a4e48ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 14.7MB
        • SHA256 e3bf4aa9e09ebe1bdd8a321baf1216f7e97bd0af8bf70c36cf13dbd9eb149785
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 14.7MB
        • SHA256 73e52d8c99853d5b478ee6aaf73afee6d6ec851fb1f0a93279a4064a1795fdef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 14.8MB
        • SHA256 da87141a5c98fb1326e3b764bd9989ea5df6e42743ae6966364cfc65a8ac6bc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 14.7MB
        • SHA256 4db18a908849bd636731e407f2339d45721d30cd1171b1e5fa4fb9c302333474
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 14.7MB
        • SHA256 29ce14cb375257717a8fd0b3032d511476a05dafc02a7b68eb909c348713f297
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 14.7MB
        • SHA256 e5a48a5a2e2723aeb685cf126274d1060fc8c5cdb2332f5d38fbccff480a0f07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download