Overview

overview

8

Static

static

3

2026-07-10...wk.exe

windows10-2004-x64

8

2026-07-10...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    21s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 19:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-10_8f13059be58eb441aceccfc3ab7c2891_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 17.3MB
  • Sample260710-ynph5aax4y
  • SHA256 36af0ba3db452d08fbc5d9489cbcdb492bd3c1240951b840b34b09ff35ed566e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_8f13059be58eb441aceccfc3ab7c2891_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-10_8f13059be58eb441aceccfc3ab7c2891_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4604
  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_8f13059be58eb441aceccfc3ab7c2891_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-10_8f13059be58eb441aceccfc3ab7c2891_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3504

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 17.6MB
        • SHA256 8be2c7679bc4440a19115cf8d704890212a20664ed2a07ec00ada4a2c1946a70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 34.6MB
        • SHA256 61789c5c0b8aa53b2bcc32562a87b4644436f0c01c0a9fd58f4b475371e39ef2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 38.6MB
        • SHA256 ef13c91a1dbc833f8e2d7893f68f84e3c38e5af5153dc2709d2f52f09191dcaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 34.9MB
        • SHA256 de47ca03257b4e8494e05068e4e4c9384f1f7e19fc3a3121914c2c18c7a78a9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 42.9MB
        • SHA256 d0a02c742d7f24d1b34d18cf7bc2b3b98093cac9ef1d9dc7e53c46689e97253f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 19.4MB
        • SHA256 a9bc5c31266bb0c68cec000d38541c0b435328ba99fae9868b8d90f7308f6f53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 34.6MB
        • SHA256 f87f4d9436cc7fc4b01409165e6d16762f1dd391245c27b7d73ae92a24aeea83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 37.2MB
        • SHA256 17119b8eb2031928c5ca1aedb0a5fe37635f7bade2eb7cf48f210813da2e0976
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 36.8MB
        • SHA256 2e36de4337784dd79474841c49819fa6ca38cd3cd260350a38c4b737f24dc85f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 36.4MB
        • SHA256 bac2c468a5507b46d1b4f73e7ce0ebf6d359a97ae38f908b4e1c8f465cd5483f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 36.7MB
        • SHA256 a6552a59306330d2cbe7a5a656eccc6bb463f65a21c1f83186aa2f7030e68539
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 33.3MB
        • SHA256 1d1026ddf7aeff0223e28a0e18f06b5766d43ec1a3f08484a26fc7a6ad71a096
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 33.8MB
        • SHA256 b8c2b9ff5b9df59e048230a070396c32ca0410a8438ec852283a16dc5817731b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 34.6MB
        • SHA256 780e360fb17e41a11ef46fd918168cc4c4cc82133f79e59877e9d2c19e6cfb12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 34.6MB
        • SHA256 ca0f5fdd5849d7e30e98ddf741cb26e8ba8b84d28824696e0d287239ae42d8ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 34.6MB
        • SHA256 0f30943c784b8e07822603d9898e566798c7de58ff4a1cc8306426895998d966
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 32.6MB
        • SHA256 125fb941e857c71369362d0767fcc98469425ee36bea369c48cd81a452200be9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 33.6MB
        • SHA256 445dfecef50584aba996806a6ccf5e6a1c5bbaf7230ca41b5ed58d44869b2033
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 32.4MB
        • SHA256 c1a369c1564226068bff760489c6753875ea708b75a3695d8aa1c3437490cb82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 33.8MB
        • SHA256 0bb7dffaa8d3cdc83a9f193033426d4566a07ba0e7cfbb56c83f1afce4189c9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 29.3MB
        • SHA256 2cb06546fcdcaef397dc82e5f31a9e5d7bc2dc33ea3ff01bac98f99c1288f063
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 32.1MB
        • SHA256 7ab1aec2d8a8fc1f60137bc3ebec47be575559b32c7080624d12130e7ccb1e9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 34.1MB
        • SHA256 d5e61e3127edb9c4d302b2b6d0aab72aac9b67aee8f0fcb42f5306de8ff31a3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 33.0MB
        • SHA256 0c711040b4cf9bc9b34f8df3811c2d8cdd8980800095eabc5a2bff570a0fca87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 31.8MB
        • SHA256 4464d6335a728594fb73aec08bf0b7a7217aeae0f86a5d7c0e2e64ea2d5b8b75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.9MB
        • SHA256 904acd4d092bbb840a08e787d10c02deb3bc2a7317e6584dd4e552157c952aaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 29.6MB
        • SHA256 06bd076ab88620128276efa79830fb2eb80132fb18ddae76af8622ef06bd0090
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 32.2MB
        • SHA256 bedeaa2113f7e91ec1e5573147f63e367f111f0271ab2dc83eb0c73d0fe9325c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.2MB
        • SHA256 95506ee0db1a33e52cb65e253d46176d45c7d0a6e4d23977dcbf3faa3e472c18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.6MB
        • SHA256 7f010ffd6c55dab6347bac3ce474966dbdd469a9dc32f8ff3da266e12a6b57e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 32.7MB
        • SHA256 fb233fcda753d42f1d317bc269fc1bf3a5a7aa6a48813033b67a560b58a93cf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 31.6MB
        • SHA256 b54ebbb665ff858c8e77668c5e1218bd5d5c0d85c733f73d036f8246ba38126b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.3MB
        • SHA256 ed51e9add3c2a704b357dd76d63dbbd3a62d0f4549e541318825378c589b8d20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 32.8MB
        • SHA256 4e35078046b81c486b16f1b62ff091bffaa69321090ff0841ac8154fb97eed14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.6MB
        • SHA256 4fe896183f0e80847ca92ae3be8814a0e9e41b393a6e8b6aaabed1ff07bc78b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 32.1MB
        • SHA256 f58469a97181ab374d49ce04f7b775c1144f66a1c9f09cb97ab68a312b56189a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 29.7MB
        • SHA256 32e411e5ac8532cc452cac25c5011fc9fed32c2d1fc7a81e7f8dd6afe207c978
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.4MB
        • SHA256 8291a8b7fdc5b3e430a9edd9c8e411bd9f9597c43b16db9e470f9b2153a93a3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 32.2MB
        • SHA256 318c591b802f98643ec2856cdbef926e41d90a74dc54186c5257aa6d206f1a7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 32.3MB
        • SHA256 275fdfe64dc90a4d40fc4e840f2849f42d696f4d3fa7d5de02e93203be3b21a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 31.1MB
        • SHA256 c8f1ab811280de20d36c62606e9a94a1feee7b8a29c41a07336a75cc76b7f5d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 32.4MB
        • SHA256 45fe3f08cefef2bb812186e1c9213d5bfecebc3fffc8649233e80145800873f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 30.9MB
        • SHA256 26d0175b37ae342d98593b6c2b47af334d1a5d34e121151996ec21279db57069
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 31.5MB
        • SHA256 b2960beec124aee10fda748be67892dca3d9379e1eb87a28dae8948cde2384f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 31.1MB
        • SHA256 04e81101eb3235ffda1203617ae29a5327feb3d24b801762f550cbf85fe1d444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 34.7MB
        • SHA256 5438777ab90b695495f56fe8636eedd29e95e4d124ee55c2637c6c85c7bd83ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 34.6MB
        • SHA256 894fffabb6f34e1ba0fa3666a7b3a6fc6d7e1f3974e0921ed7034e44145e9291
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download