Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 01:52

General

  • Target
    2026-08-07_13c24b1a7da7c9fa421248f8f4aab66a_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader.exe
  • Size 7.4MB
  • Sample260808-cadntazzhx
  • SHA256 c6d8cabe2e4ebebc1db2f2a909d87f00fa45e1c24ca76b9176ede6f655f060ab
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_13c24b1a7da7c9fa421248f8f4aab66a_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_13c24b1a7da7c9fa421248f8f4aab66a_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2752
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_13c24b1a7da7c9fa421248f8f4aab66a_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_13c24b1a7da7c9fa421248f8f4aab66a_amadey_darkgate_elex_emotet_glassworm_hawkeye_icedid_remcos_smoke-loader.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4080

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.0MB
        • SHA256 e42d25c7be279ae7753db161c39941e7c786ed314ba3ed1db06aef0005e6cb98
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 14.7MB
        • SHA256 a7fb3a64285f213a486c63106e6cfdb0aa664617c8c708ef7d7fa62bd0e9d4d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 18.8MB
        • SHA256 227529383d6dce9e8564150a4f3dd46aa4046fbd219ac12816c02399fa3c38a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 7.7MB
        • SHA256 4cddf5316b67670330a25c4c297257ab39f5468198a9abc428abd086ba5279ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 30.8MB
        • SHA256 ed700d36955e70ba8afe819ad8d180d49c7bc87daa7006ad49df1f5da9346a56
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 9.5MB
        • SHA256 aeddbf863aee719e610440ff2ca9d3410687092787b8f9bc2384738780b65101
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 14.8MB
        • SHA256 529bd4c9206b107e7ee878cf986dac088b1f366decaf9b0314053b13bebb9666
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 20.8MB
        • SHA256 da3a3b41de31e4ac48b842138aec086b39bbe6c7d5b7c65d4661ab6cf13c083c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 16.4MB
        • SHA256 bf303460240b28d008cf299feff4d9fb82adb8c16fd326f6fe5f3d6e07095f1a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 18.2MB
        • SHA256 0f300d820827f84edeb45e549159cd33d17827b1b62d8880773a0abd67fbfa62
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 17.0MB
        • SHA256 e95ca0ddf628562372eaac1b4f70426f55a469b8f274bd47906725848e868dd7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 16.3MB
        • SHA256 31339a054ca10514f847af72e6b683128d8d7f9e1b6db38804ae8e9a09db573b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 16.6MB
        • SHA256 b50293803dd54cce985eb8e076dfc6474441810dcb001456fe61d7dac88e2dc7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 17.8MB
        • SHA256 bf812c7d901bde9e3f04815c2f218444e13b5e4a966282254418629a77a57f1a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 16.1MB
        • SHA256 36f4a88e0eed95fb195c1bd4e3b876cbf82ef1e1317059d4918b9dbad20a992b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 14.7MB
        • SHA256 274576cf65c89ae47d019951dceca5190680d02fa2a2e93a61547f8b7f19d6a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 14.7MB
        • SHA256 ca12adf40dba63523ad33411790915bb3ac62ce163c04508b2e9e8c3462f98bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 14.7MB
        • SHA256 6a242b4964ba943de80fcb129b71f5661c6c431cd6459fe734bb14560509faf7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 14.7MB
        • SHA256 c40b7c3224d93e9d0f3be7f4dc5dcf2ed790b4c76d5676a6cf037a1168bbd37f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 14.7MB
        • SHA256 242355d8ff045924169f04f9bebdb1e494c25f5a92a5b9e6bffc3fca7afe0762
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 14.7MB
        • SHA256 951d6fcabe5cc9f98fc4bb0936cd807d5bcf9330b347181b44b0c815b25ce3b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 14.7MB
        • SHA256 6a09ac75843a5fee1a89d3b778e7c9733fd41b5dfd407cab3fcc5ca4da137285
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 15.0MB
        • SHA256 9f93783bd3a94a4c6a126bbbbef9487722dd6bf7f1dc60a2a432b6a465fbddda
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 14.7MB
        • SHA256 e5f8b78d6784bbf06d30deebb9b9e9a127277269eb9db61d14bb5ec94c64f0cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 14.7MB
        • SHA256 fe0d18963c8d165c8e29b0cf62036323b5ef7c19d39398e197f1147cdc0d5f21
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 14.9MB
        • SHA256 255b8489cbe0f078553d9f9dd5ba8393c203272f0b3729258b1c6e8e05467c0d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 14.7MB
        • SHA256 244c12481b19f88ca975efae4aa0ee1ba29d639614ce589ecffedb63208f0392
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 14.7MB
        • SHA256 d4448244d480585f049c4ee6b36c8b0e4b16e7fb6f536cfff19001d7b0385abb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 14.9MB
        • SHA256 54c2b6cbb2780701b2d0539eaa6e3c235813eafbcfe9002a4aba14e88fda8f7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 15.0MB
        • SHA256 a2910df01e2a42ed3701d254818835bed290316cb302845357cf671a0eb60825
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 15.2MB
        • SHA256 743796b601d4b968b3e4c386e3e9a15432829ae08d05e603dcce1dd95702f35b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 14.7MB
        • SHA256 58abc5e491dfb263697c793d1b19e7e86ffa702811a657a15f1fde833c7a8d3d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 14.7MB
        • SHA256 9a0ef834dee26a301f8647f69c89efa2de8ee47f9755a451f8845373c192d305
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 14.7MB
        • SHA256 b8418ad4bd514b5c5d5d1ea1a89b7cfb5c807563ae130274fa663e923340ee0f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 14.7MB
        • SHA256 956ac4d68c3f3f546e40643e34b3acfac88241eecdaac7ceea17459c54be4073
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 14.7MB
        • SHA256 7551fac60bde3b8f961a50d981d9b6868885065fc15193e42ee49bce9c0857af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 14.7MB
        • SHA256 13f8eaa0b1120630ef400e489b0c6fcc7629d61e57790566381dba14b56c8406
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 14.7MB
        • SHA256 1927856eec8abd033673517ec78152efcab13ce6b523b42b30f205d8ae97df1b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 14.7MB
        • SHA256 e6ad7f9770faaf50dc6a77f8dff313ddd0088f3e7da18761edc2d75575b963a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 14.7MB
        • SHA256 fdf9b39025d5a56dcd637898654b325de1b98500d6a7dd79acc2cbf3c2c3418b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 14.7MB
        • SHA256 3e47a62a815ef2906d80639d87d1b42e39a44492e28ad2039cb8d889e18d7a49
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 14.7MB
        • SHA256 e294f6efb204dcd16746f29929b49f021eb73c3468ecebc6c6762bc10bf1f113
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 14.7MB
        • SHA256 b66d36374d704561a37d1b39578ba14ec98932374c091bbaa6e00ce4ea427a1c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 14.7MB
        • SHA256 47587ec50567f0a9fd779ac92c11ddbf0faacc95549d8d2f7263e033e5089b09
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 14.7MB
        • SHA256 2fca9a9c62084bea908cc1caf8201d10f0de8c976ba1d7ee933375ca0720da47
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 14.7MB
        • SHA256 57fc051df46745ee48bfcee7687b046dbd90ee00fc9a581162b6de53b19b7bcc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 14.7MB
        • SHA256 59c2bf3d07043e52a0bd5291ae2cc1936b77cfe09c8f161b2c23c195eff9ba23
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 14.7MB
        • SHA256 72fafcee02fced4f8647cddb41b706874b1d92806486216d60009138128fe9be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 14.7MB
        • SHA256 a3af14e60363f1e961f8ece9e367bbe236f0feeba8d22b7fa91e3d4c1f90e7cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 14.7MB
        • SHA256 0b4cc4845e65824bfc71da8d9c0d7c9423da4058d3bb3168c42f4020da2cf878
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 14.7MB
        • SHA256 6b310b90b4f81b26d629312aabbded909fa6d6a526d89903e365e924e69413a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 14.7MB
        • SHA256 0740c31b78e3a447eb5df00f693a5f6654ee3e4a97d7ea8f990cb94cfe8050f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 14.7MB
        • SHA256 c5024ab27708d97c1d79d345a718028178db19465871b8d0bfb9cb87935e53c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 14.7MB
        • SHA256 62be4966251b7849b04312245583761bf2b3113010fe952cadbb88650337d7c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 14.7MB
        • SHA256 e9e8d7cae2af8a2cae4867e5cca42606d427e215b70372b480b38797fe030271
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 14.7MB
        • SHA256 be70d2a973b642cf834d663b2600704ac86e0f06e500933466f76ea326964cae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 14.7MB
        • SHA256 c8933788e166fd911f50563a14e909779c092ee6c003754f592175419131db11
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 14.7MB
        • SHA256 5ea8b66e7b2f19fee60295dd172584f4475c8a97b3783c4d97a8fc41916fba52
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 14.7MB
        • SHA256 83e41048c647a4d5fe6693635c0d9eed030f55875ebc9d84b7daa2359bd0fa58
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tnameserv.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 14.7MB
        • SHA256 5c7933276707e80e0d77e95685f80466a737b7881d05a3cc7bae4c8915c87152
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 14.8MB
        • SHA256 3e4a8510e9c5ae2008e8532724e1f0194240f6cf1ccd967ae6e5b0eb0917f0f5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 14.8MB
        • SHA256 690231164d518c7b2cde72db7cb385f2901678cddff9368ac13ef45a199c9571
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 14.8MB
        • SHA256 b7f6a676281f32f217162db7425e51581f278eede79b406eb53b5a5675101fd3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 14.8MB
        • SHA256 953bb509ff5e3caf5f558f52edde3525a48c005e4eaa5fbb1137e0f21c419de1
        • MD5 SHA1 SHA512 SSDEEP TLSH