Analysis

  • max time kernel
    149s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 20:01

General

  • Target
    2026-08-16_dab8b3b691471cda1232c1e339f312e0_amadey_darkgate_elex_emotet_glassworm_hawkeye_remcos_smoke-loader_vidar.exe
  • Size 6.7MB
  • Sample260816-yr29dsff55
  • SHA256 80eb2b4bb8d07bae79a156f2a21376c910667f4e42a7f8ef9cb6ee1797cdcce1
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_dab8b3b691471cda1232c1e339f312e0_amadey_darkgate_elex_emotet_glassworm_hawkeye_remcos_smoke-loader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_dab8b3b691471cda1232c1e339f312e0_amadey_darkgate_elex_emotet_glassworm_hawkeye_remcos_smoke-loader_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1236
  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_dab8b3b691471cda1232c1e339f312e0_amadey_darkgate_elex_emotet_glassworm_hawkeye_remcos_smoke-loader_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-16_dab8b3b691471cda1232c1e339f312e0_amadey_darkgate_elex_emotet_glassworm_hawkeye_remcos_smoke-loader_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3248

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe

        • Path C:\Program Files\7-Zip\7z.exe
        • Size 7.3MB
        • SHA256 0a72fc11b464106e969d62f43994b5ed865defc021c2ec7372380a13b1702198
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zFM.exe

        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 14.4MB
        • SHA256 e54b8a6d16036776ce93338ef0cf6d653d72aec53ecf9319945c7367293dffd3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 14.1MB
        • SHA256 4abad5d69fd7ded006de44396d0722a9830eaed4cb91d2c48b6192414650ac0e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.7MB
        • SHA256 793096384fd03d95c9d6980d75166c8cf4fc1a7b41fe6adb815e78cc39109ad7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 7.0MB
        • SHA256 1ae51217d5822b6a52043917ce5d8ce6e3d458cf0da81426f2341aa071ad6366
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 13.5MB
        • SHA256 5e70a86c57bdc6cd3d66a1de27b4ddad61e19496aac9d555804bf0197771ce90
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 17.6MB
        • SHA256 e07672699aae0b98405625328fec7234809cd7ae0cce46e771c5c1021a47322b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 13.8MB
        • SHA256 73f6e6e87f29cfa3599c3e2207b4e20dd8ed60281c53d0d945d7fda66db4a9fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 36.9MB
        • SHA256 52a7ffa5247313d3a6c7cb40351a0739e1ab0eeab9a3e4b6395595c47df7d69d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.6MB
        • SHA256 d2cebb0d0488580df6dbf01f1d70e966906e2e6bd134680f71cc5e7ef82ec2c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 13.6MB
        • SHA256 725ea43c405cfc8f92961ade9cca96012f4a6f00dadb0d09bc29d1f6b827707e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 19.5MB
        • SHA256 fb8ee6cbee48d5a709bc6f0e0197eebfa3217067b007ba90559b84a126e03a24
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 15.2MB
        • SHA256 c866e5e4bf5c772ce914ba3c2c18cfbdbb7b23f0c8fa007ac741096e54fb9b09
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 16.9MB
        • SHA256 1f618c3808d509ceb51f4406211a5d5d745682f9ba158f023ff961e575d93800
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 15.7MB
        • SHA256 7778dc4e1630b7c489522e7b4a667eae6373fcd1e6b56b83f1cfebfafe4542bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 15.1MB
        • SHA256 d914c200b26ac84056c276948a1b1f8aafee4dfe3fa29572a2fad2a581b2305d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 15.3MB
        • SHA256 e8bc18af7566a205d1f1779416c6cec8209d6695736aa853930c930663d421cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 16.5MB
        • SHA256 7d11dd64ef34922242c7b93182e80e460ac043204084997b122a1934eb19754f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 14.9MB
        • SHA256 c543fae97f7241b5b94ad10b183cd3829bbbdbcecc8a5d9afb09fc7bbb09036e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 13.5MB
        • SHA256 27d3229a6d88c834b6b9467c5b1145b0359d356be2d45d9ec79ae83604345a61
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 13.5MB
        • SHA256 b8c8a12a1c580d03f7c2263bb505014c01cead2ad13201c06d1b5720d9b8bc3f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 13.5MB
        • SHA256 1c24c362deacb858a1a40f9ef622e660e260cfd96e5db809e14085ba82f87896
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 13.5MB
        • SHA256 3c2e709da66d9e20492d627123d8f78cc55c86c2867719504a0c7dbb4fe43b95
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 13.5MB
        • SHA256 19df1362c63f5ff26a393d84ba30e14d77ebfba013173fa33319bdc48b535f54
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 13.5MB
        • SHA256 c05c6531139a25ce9028bbe2a957e2b7417593de0425b9b50d1f74b7056c46c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 13.5MB
        • SHA256 ed75eab0c2a7c1e52ee792444e9e4942b06de1b9e1eb6cdbe6af43f41c6adf59
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 13.7MB
        • SHA256 bfa6fa00a8621fcbabce735b95557d71a2a487486cef6bacf9e3595a16f1495a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 13.5MB
        • SHA256 bc57cf1a630df0c549cb519996c309a5c4bf7a4b1324b83d9eaa155ea8396468
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 13.5MB
        • SHA256 1bb9799e39ef0992c137f90a1a5d71d24c98db9c6e24e1ffa049669e37cc1731
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 13.6MB
        • SHA256 a5365e5bb5f29868ad176109e0ddd0b6d30f1729e6fdcaef5c45115228e1ec66
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 13.5MB
        • SHA256 89da02c3b990d7e2de83b8fa811e7c28af27e8a779832bc7100c5d23641daa42
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 13.5MB
        • SHA256 e4c1ef0d43e6853e87c9c2d2808073eaf1ae15e379c87a0405ed2c5222b02c31
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 13.6MB
        • SHA256 5fb1d8387baf1e4f6d92cd23175c51337e01290a8c39967e6aa05134d1cb64ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 13.7MB
        • SHA256 c8f9757b80b72cfb26bb78978f5c8b2441be4fd6fd73a17c177824f4bddc6e7a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 13.9MB
        • SHA256 9aec1e50e65f35fe95aea3df4f20680929c32c9297be9a2dec51589e0c66b122
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 13.5MB
        • SHA256 ff4007c8d12f2c4c0b8856c781a43e4f465d3dbee5e15e0c4720b4ec57eaa686
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 13.5MB
        • SHA256 4f3e42c4afadf3820744f55606c9967fc1e56bc43d3100c232b27488861177ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 13.5MB
        • SHA256 169f6e0924902a5370c45a44c208c74975b524340c6fe8fc12be120b001c7318
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 13.5MB
        • SHA256 e10fc15ce314e4aa4d3c3390fbf7d8cd8de00b2c3691857f70e95b70511dd904
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 13.5MB
        • SHA256 b7c03d923b93337e58cd52ef1bf717e4fac7e74b3aa8b74c4dd060292019e6f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 13.5MB
        • SHA256 9fded2ff8c36147f5ca825cb7c4a301adbb1199be499e31fe9c29b17b8694d5d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 13.5MB
        • SHA256 04587a44029dfbc90690fd29b96a7cf2f03d6dc721d17c52c7153e5530f281c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 13.5MB
        • SHA256 094a083268db122e8308a541914750ad7ebddb3c367edd6737753eb8aea4bdf6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 13.5MB
        • SHA256 4efae9b8781b71d88549ddb954cbebae8b15acd18dbf037c44a6c3631ddebfa5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 13.5MB
        • SHA256 e791b79d9908b83e9fafb6e97a63427fa0f61de1849e88a06a7c723f447bcbeb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 13.5MB
        • SHA256 5ebb875e7fe4853de58e81b0655bfaed51044486a7adc959ae91dc26cfc33ce0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 13.5MB
        • SHA256 f06852fb5b440041fa15a166676e778d2117158106f2ed54dcfae2ccb933f6f5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 13.5MB
        • SHA256 1cff57badd5103a4adfeaa61eeda5e8db3c601ca3ee768a1d0a5838b169f3bbe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 13.5MB
        • SHA256 fb7e512126be71dbf5da6c579ea376ab8fd5ebcedcee3ce5d24261cad78c094e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 13.5MB
        • SHA256 efbda501ca6188793e468ebe8f81c7bc5a9406b39970f2c286d744e701eb4a4f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 13.5MB
        • SHA256 1c1490115e9355481958fcea357627b2ebee6a5fb5d6d47c6939f672ce5f0299
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 13.5MB
        • SHA256 09e326f163ccf57fc34c52d372cec4ec3a8855950fbef7efe670b0c11ec6d975
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 13.5MB
        • SHA256 ab58da9fd2e53bd048e4b85284d9e7a14ce950010361ec179165b189f99f3950
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 13.5MB
        • SHA256 3cad60a6ad31701f80d4dddc191c7b3d28281a76118b5e04f63d0d6fed98d967
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 13.5MB
        • SHA256 10bb05a0a245f3d1773a1f57086b66fffc6340ec3960f8bc0d1fc579c2d8b2ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 13.5MB
        • SHA256 c52a11b8a38757c04c412edbc42077d8491376aef7c5509118848c25b3ba6cf4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 13.5MB
        • SHA256 9f895ec02bd18b23ed245e7acdb97473101e5d2665d776a7ec183220dd1f83a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 13.5MB
        • SHA256 de461aa6ca4c2184a4c021977f39ffa99625919ac89750567198691a36844b1b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 13.5MB
        • SHA256 4346a36ba70df91ed4092cdbc65de4967adea5483b93659f2b42b5052f1989fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 13.6MB
        • SHA256 1f7933075511dcea0da940066eb0e6d63da191b2bde65fe4af522d55b378ec6b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 13.5MB
        • SHA256 8ca82084b8643b8494d36094c61e8a0a4d200e8879d460bf7aadf1be8dc1512d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 13.5MB
        • SHA256 ef6f43251b6927379a902f6315df231e5576831a69e115021ca972a4f979aa73
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 13.5MB
        • SHA256 b17f81944a7de533664519c34e4ed7e64a39b414f443bba57ebbd3a50aa296c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/1236-0-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/1236-1-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/3248-26-0x0000000000400000-0x00000000004E4000-memory.dmp