Overview

overview

8

Static

static

3

2026-07-10...wk.exe

windows10-2004-x64

8

2026-07-10...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    44s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 19:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-10_aa7e8c0a2b82acce193f0dbc54cd3078_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 48.0MB
  • Sample260710-yfn8dsfz8r
  • SHA256 10a8230a65eeb67d09a65737be02637c09ab7931c77bc1afb64c4f3484c03246
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_aa7e8c0a2b82acce193f0dbc54cd3078_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-10_aa7e8c0a2b82acce193f0dbc54cd3078_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4436
  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_aa7e8c0a2b82acce193f0dbc54cd3078_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-10_aa7e8c0a2b82acce193f0dbc54cd3078_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2604

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 48.0MB
        • SHA256 334fa04e71a7f1a9f68c3762b07808f96d329c5996eff8814615e5aab012082f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 48.3MB
        • SHA256 0e3d5fcda848172ae147019d0d67dd220683cf9bb422ec71ad5ebce1656ffaee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 48.0MB
        • SHA256 10a8230a65eeb67d09a65737be02637c09ab7931c77bc1afb64c4f3484c03246
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 85.7MB
        • SHA256 e5b159344c865e11bc1e78c8899883af10a95913ae29ab12b57fb502a93c087f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 75.8MB
        • SHA256 cf26e2855c60d90e7010378420ac6a7874fb7d4fc7e78d4ac4500af2186c6d35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 69.9MB
        • SHA256 189a2d92dec63d72b25e9223cf1527aa903cfc1d0447971c51816885987344bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 69.4MB
        • SHA256 2a72c2272a5a9ecee7164f610779ade7df5498af86cd17df76bac953196cda38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 68.0MB
        • SHA256 b78a2b1abd9ad0263fa8116030027b0648b01b67044f2345e4f8f9953698f6ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 65.9MB
        • SHA256 cb6b3937a2ffdf7fe486c63c23bfbf1338f8b3152e88c7ef6bec3c40a360a97b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 64.1MB
        • SHA256 0cfa2d3d4daa8af0f73fca80a21464abb2b0d1d17474f5df7c432ab811e1087b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 61.5MB
        • SHA256 543054e3dabecd24dd3ac3d0d84dba6f47858750ad55404ead5c80e5f863a1cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 60.2MB
        • SHA256 a6dbbc5f89847a3d4dd48e4582a517d188f72aa3b557b4b043503e2394c48c88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 57.8MB
        • SHA256 b22bc316a4659db7076b94f6131fd996e1f0b415863216b6928c53060db09c78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 57.1MB
        • SHA256 1919e3ca8a3e57daaf725fefab77fd731efb8ef50a8954d806941abf7970b254
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 56.7MB
        • SHA256 2e2b41cf7d1e767810617402970aaa45eb93b860740411ab515585b948c01d31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 56.2MB
        • SHA256 4e2b250291072786aa0416694bd5732c5f9326b56f2967e15f28247d1de3faad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 53.2MB
        • SHA256 b7850003c7cf839ff1e86108c9e37bf81079792b0778856fbdce377a7a9c3e99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 52.9MB
        • SHA256 2292f485dcd5b0d0a45fa0f58dd6cdd7bad881770ec89f7a4fa35af136448772
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 52.7MB
        • SHA256 fc93a72e56375914a6df68233e1c6b90ffc382fe7494cbf37871a707dee97c8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 51.6MB
        • SHA256 5a936d8919afc8b81a0514f880eec127891731a97c1059e409c2e6fc74f8bd63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 50.5MB
        • SHA256 7dde9d1445e9daaba281639179ddc91b2a8afa12b3f1bf626702b4dfd0cb8e13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 48.8MB
        • SHA256 1c56b63c41b12daeafd298ab2948d4daff65a4233b7ca704e70f741b240ec388
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 43.9MB
        • SHA256 9f8316fc67d32fca41c32c0d03c14411e0a6778bedf97c7eeb66d02c493fbeb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 45.2MB
        • SHA256 62482b47fcdc9ed6129fa4e25fe1ebd87579acbea976d6f7085a050f2865d669
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 43.5MB
        • SHA256 3ba1bcd7efbd9509d4aa45945216b801d620f9eb0cda25a0eff342662bcd160c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 42.1MB
        • SHA256 f8de3f932446ccafff02a079a445ebc98b06a0cd26138c932c1f780a82f957f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 40.3MB
        • SHA256 6a2f1c0a2c37205478e496b0289cba3316669678921822bb20bbc4184a88fa3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 39.3MB
        • SHA256 21b0e33f0faa1fd5c5f197a94837f7143b3acbbc90bf8b847c56441dfabfaf1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 38.2MB
        • SHA256 f7e23d2184678cfd61e700dfb1cad640547aabccc10b8380c7610f90e31a7dc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 37.6MB
        • SHA256 867fb851c0073ef8a5bb8574845424b567c917dd2be7bc404f3e5076aee77113
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 37.2MB
        • SHA256 d38992418f2f98879fd3fa61824632312b4b1018a123b3b75d4bcbbd8f6783df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 36.7MB
        • SHA256 3a3cd1619b8c991f0239f29f048189e6a609ee8b13a28f2488b6131c81488f7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 36.0MB
        • SHA256 83009fde088536f9fb4a17606113c7228a4b317ddd526c9fc2af34ed49674b96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 35.2MB
        • SHA256 5cbdef30af4052574ae4cf8e52f4634046b0018abfed2285ab1c87c09bb75eee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 34.8MB
        • SHA256 8b91c3db6c52f03a1cbf9fc6742e01a632f9b04353ac82657e01991f065dfa17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 80.4MB
        • SHA256 f869153dbcff6d89948d53355e973d5c7f9c02dfa411c1f0172194975f024797
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 79.4MB
        • SHA256 71b737f1ce93890c3f9c1e123292f99b82f69dde016e389705e436025ad04aea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 78.4MB
        • SHA256 03e40cd86e8589a60325bf67db6bdc96a8cab219dd7eb77d41e2abd6f2379320
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 77.9MB
        • SHA256 d6fcfb18f508dd01bac27e0b224a372767bf74825a9de2deed010d9364496927
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download