Overview

overview

8

Static

static

3

2026-07-08...wk.exe

windows10-2004-x64

8

2026-07-08...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    34s
  • max time network
    123s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 04:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_b6535cf63b45ed55858ced7d3008116f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 35.6MB
  • Sample260708-evspksbt7k
  • SHA256 12fd48b3ecd357495382fca4dd86af903dce6e50611dcb952f0e7a47c05985b9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_b6535cf63b45ed55858ced7d3008116f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_b6535cf63b45ed55858ced7d3008116f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5624
  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_b6535cf63b45ed55858ced7d3008116f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-08_b6535cf63b45ed55858ced7d3008116f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4624

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 35.9MB
        • SHA256 0ecefea79975716d19a59c17b588b05831ec7632fbb8998fade005e9b252f29a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 35.6MB
        • SHA256 12fd48b3ecd357495382fca4dd86af903dce6e50611dcb952f0e7a47c05985b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 75.4MB
        • SHA256 a54104edfee6e356335a32776e5f9e6d4e367a236664ebcc00b544c3cc8919bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 71.6MB
        • SHA256 9d54c7e228e9e86b6c5e979fa66f2554b79ba9ed347b9baa16da9664dc9db810
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 37.8MB
        • SHA256 dabc07ceadf6638ce78a1baf9cf09b4d68b2cd2175f1f54e25d39b4ab42654a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 71.3MB
        • SHA256 ff7f2c2f076d201274a181c990e0ee21f7c1a08b2ae079ea082a3eb55219a0a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 67.1MB
        • SHA256 7807ed8536f842a86febfcda39cf755b1df5e4bd87ea02d9772000c9d664ec6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 64.8MB
        • SHA256 272bb347b3cfc726d8dd1082b98c38b1a2ed2cc38f14a14e003c152ce9a473b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 71.5MB
        • SHA256 e838cf7b468a44a6a637b1c58c6e357bca905865a71446cee3677e517b50e1d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 68.6MB
        • SHA256 1e07bfd0a0841443a32b6a5fb329930943a4a0c8682f344fe3ca3d71fff262a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 68.2MB
        • SHA256 09b09920e17fb159d3b29bf8e0f93470198d36200d872a1cfacd19bfaa81142c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 65.1MB
        • SHA256 4ad5b923d3a0d31fc22caf023c7c765c8e627bc77343a6b2337831c6dd4e5912
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 61.5MB
        • SHA256 14a87142690ec56729df0d8a8f26d1708019394749c97a2a57d9d9e1391d64d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 832KB
        • SHA256 397620bf0f241c1dd0b3fc4d8c6e86a8de21b3ca195ed9cc0cde9f37ebe51777
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 57.9MB
        • SHA256 053d5c5a28eee7d44b5ae7fb66e2eb3bc5fdd8a465e422adfcf228b90a103c92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 57.0MB
        • SHA256 04dc5139b7ca77d8095e9c5e1982a6b12dc52af88551c2c801218a01a0a5a016
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 56.7MB
        • SHA256 f3e6bd9930f42fd7fd3320bcb206331e1510db5909965979e1ffcdfe55b839df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 56.1MB
        • SHA256 492f3715c43f4957a2fc5a1c7b2b1fa9f6a2e4a46342f8878e9e23b37ff85f04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 55.6MB
        • SHA256 03ca796eedc835aa137b1f50c598f841245e4c1a2546af3bfda2c61db930d1b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 54.2MB
        • SHA256 89ff52568c932459099326afe3186b2a2e9a324486a4ec994ab6580d42683868
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 52.6MB
        • SHA256 2baa583c51dfaf2003d4d8921ddd6e3dcaef5c965c6169a1d29c625297b7dd28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 50.8MB
        • SHA256 de5979f65cad385041d942e6a1a96ea33598d965404bdaf4aa95c3c2813204b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 49.2MB
        • SHA256 b5ef22884276615a4fe9d9e9f8d6a55007d4966c1691b30f91cd776064de52c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 48.2MB
        • SHA256 837782ba67b2501d903b62c739a1c5b0e23a928be7f859b5437d81f6e63bc6bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 47.5MB
        • SHA256 2955064d844cd84464bb29c2a0ac0d50847e8f2accc05305c871bac8c543a4c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 47.0MB
        • SHA256 88c721b40598e0d16bc0c5c20620354aa245646218e57d5df808b277b13ad3d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 46.8MB
        • SHA256 ebbec2aa1713a9615e1ad4da60a4e212fd26a8df80b378283f76f1ff41b24499
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 46.3MB
        • SHA256 7b665040cea2548db8f754be4dc767be1f321c5dc0a381bc342b94dc0b46680b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 46.0MB
        • SHA256 d92eefaca2b6e5dbab0c906a9428b1efb2bc1066bd8859ddde5f37f7c0356c00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 45.4MB
        • SHA256 a374b97115e7b011231efeea101ee624c06d43671dfa682ee5bda6410d9df236
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 45.2MB
        • SHA256 fa84c55dee3a4dccf84f5f04f9040189fad57c06a21ce233cc5f2fea6120862a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 44.9MB
        • SHA256 cf30c331e073b457950e9a8c383f62ecf7776eda9206a2d06cbd9097dbcadbb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 44.8MB
        • SHA256 8852dcad482250bb60877be680589c44d5b2410401b0f2d4ca76b457afa90b41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 44.2MB
        • SHA256 c839b9081b7e85cf8f49556a0d2ac0eb4c84f507b77915356b09c6a98c854176
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 71.4MB
        • SHA256 56ba177e5905d1f271a06e77fee77051a98e836e207be8090e254db90a3641b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 71.3MB
        • SHA256 c91cc6bdda0b2be576de8181cf24a95f75cbcc327528b84c519417f8b455bdf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 71.3MB
        • SHA256 71aa8b0c7f6de5e6f4126c70725e62be8234271b195067653eb22e5b28465c34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 71.3MB
        • SHA256 421a83211b4e7bc95915756383338bf529a962d13551085665470604216365a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4624-30-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5624-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5624-16-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download