Overview

overview

8

Static

static

3

2026-07-13...wk.exe

windows10-2004-x64

8

2026-07-13...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    51s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/07/2026, 00:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-13_ab3d7f72b9172d8a6e77121800975bd1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 20.4MB
  • Sample260714-a6h73ady2x
  • SHA256 fc93f377d0bf364ae385a596237fd3000db54a995db014daef4b952ca8e73333
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-13_ab3d7f72b9172d8a6e77121800975bd1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-13_ab3d7f72b9172d8a6e77121800975bd1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2548
  • C:\Users\Admin\AppData\Local\Temp\2026-07-13_ab3d7f72b9172d8a6e77121800975bd1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-13_ab3d7f72b9172d8a6e77121800975bd1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3708

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 41.1MB
        • SHA256 46fd7c89a883689f4e05dbdd0211966027e2d3ae8bb01696c3098b754c903893
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 40.9MB
        • SHA256 32c12a6e0f9922bdb998601ca38fe0ce9e836ef881487e3ae739e803249fb50e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 44.9MB
        • SHA256 878a14fc605be515c80c502e659647573d063ebfd03d7248af595a3fb1000ff4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 41.2MB
        • SHA256 55bed03459812c04e3a1b58facf337887ef897f51cd98accbf544d443f5ea60f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 64.3MB
        • SHA256 1e3598c5d5787a1609a7ab4872547046ebab4b8e15c038a57f6edacac7652b33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 22.5MB
        • SHA256 d7b714c5e6583b2e4689289dfd8525e7b7dc61d891bf36c5a815ed55bc870bcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 40.9MB
        • SHA256 71c22b43926a07a2c5ee66e1842a1f531fbad6a70c52a8584d94b9103377a2d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 46.4MB
        • SHA256 cc6ef9357549fe9e38efe3d2a335c97c906e3e8a37f9edf33da7bd78e0aab768
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 46.2MB
        • SHA256 e4a3a18e854d949e07d84f8ddbf13282efc6e90a0ca5bcd670aca7186123cc4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 42.5MB
        • SHA256 9eef36ae9f99f65a109ba74dbfd8922013861e7b0f4c28816fc16f4f8b785f43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 44.3MB
        • SHA256 0735c9e04b5242142925b5900541db0145dfeca1c53f2f5ff2e53c19d90bd513
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 43.1MB
        • SHA256 32c6f96abf6244cc6c39a61f3e31a75d73b4ea2cc19b5252f633dbf2a9cf84c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 42.5MB
        • SHA256 ebca2c3c73ef2c0d57b588da5f4f3f9e75954f005b7ae1a9c825a1b14c5c8c01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 42.7MB
        • SHA256 65449987d646035db8dc69ef787a38d0fdfd03b98bc119b8fbf6435ccc21a0fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 43.9MB
        • SHA256 961fc3fcbb40c2765495f0b037ed7cea1f51609b7b3d569701f0468c138d9332
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 42.3MB
        • SHA256 ee3bb2784db57582bb2a6997a419cc2f8e9fb914b2b0779dee6c7ea01c3d2ad7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 40.9MB
        • SHA256 4d721b220c4e6600a747aef03fd948311328c7bd9e3871ee2fb9aa660b569374
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 40.9MB
        • SHA256 45fd4ef6032e5df6041ab7a6a5acbabd07153ced2a265641f33a934e8dcd909a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 40.9MB
        • SHA256 b31859a7a995d50046e6685950ab598ed577addce2c2316388e04106836061a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 40.9MB
        • SHA256 bcb265ef878ef17d93bbf00962b79d5cf018fdf83b1db994b5f114d18394c2de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 40.4MB
        • SHA256 a58ca37173eaf59493541631ff9363ca88184d38fc219dcc32e46af37a68fd77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 40.2MB
        • SHA256 b208458ca872f63f173f221737f75d03ddc681b4ee49dd5b6428b07428539c56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 39.3MB
        • SHA256 d0535229f6350f10a439ec31dceacf5391db0b7228798ac0798ac3705a0235b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 39.1MB
        • SHA256 9b58b32eb0c85eb2e769eaf5e824603cff3a22a40c7389f6f5c9a0d6d32299fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 38.8MB
        • SHA256 f26fd2aead35ec187921186222dd9d6665df2b1221fd3404d546c03aaed054db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 38.1MB
        • SHA256 bc467c18ce9896fda2d25c557ee43a67e8e45ca4504c6928dcb4be6086630106
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 37.4MB
        • SHA256 bbf0c1b92189488cb4914a5abb3f244391c21c3f3fe7cc5927436cc648b75d60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 36.6MB
        • SHA256 037144421c913649f5daaf88052bf5c6a655b59b0ea4cc60825721923492388c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 35.7MB
        • SHA256 ab8c8cf67850f9c063b37e25a12da00be599fe7eafaf7be81443987029d3e658
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 35.4MB
        • SHA256 c6e32baaf6c2b92f2672a92d15f67cf7ca380fb3cffef86f82ada142d9b5429a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 34.5MB
        • SHA256 5c4ea30bf3d8bb07b40e0a43d3c0770f4882c8bd014cab5ff77bd41240601de3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 33.1MB
        • SHA256 e5cb6399d03648d1c2b312a565b9f85a2f1ab6935c401f4484433b95fcee55f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 32.6MB
        • SHA256 fbe6b30007930d6379f638f0a949aa2b0dc65c88b8176c46ea51bc518557a694
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 32.3MB
        • SHA256 21ef4154da079a5244ece31eccb2ff188d218f14f438d9c09664269b04640120
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 32.2MB
        • SHA256 c2109712c8f9288f2f7568a8aacd6f5c5aa0cabef97933ee3aa0f405e7f1ad53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 32.2MB
        • SHA256 08b924ef3d91f9e32543feb88d76fe023e2d8ddc55b3fa59d9537ec79d5df284
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 32.0MB
        • SHA256 1562f100255035bb839564c407e51f22e00a1bf486b49985325f4757cf5b54a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 31.9MB
        • SHA256 80d6e36b7fa3829450196d8dd06db6b11cbe09384bbeafd37014d68361d47c91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 32.1MB
        • SHA256 50c24f3190a27a1a37896eb86dc203a7de269a1f382cbd08159017bda5e31aa0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 31.8MB
        • SHA256 b01739f71719d9a8d62462ae516a2808c3e09ec78f18c6c82da3c2ee46ec5f01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.6MB
        • SHA256 e7005218deba206325a0d7c8bf99770b33343f9e2df6a8835cddfcb9653e6bd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.1MB
        • SHA256 5b7e5fecdf59b08f94239df706a47c981bace0e2871c58ba116c29c50b46083b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.9MB
        • SHA256 6d641b8ca78b349be4838d47fad5f4f61a208e07ac7846a52e83d4bb55a0e20f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.5MB
        • SHA256 468c34481e324518d477c1a5876cb5490767e4d2a42b8d5c2eced4ea1e0558c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 30.4MB
        • SHA256 381a13325e5b795e0aea8374d24fc6d4722253228c654f424546b080be3834ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.1MB
        • SHA256 8dcf74306091c0e18178d783238e7caecf1a79a67dbaaa8dc035c6b25b0185a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 29.6MB
        • SHA256 b22223564e587f184f658f6ce3ec56b64e20e05b2d43f5a5180632763d978457
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 29.4MB
        • SHA256 ea747ac3435c7c5aa7147b162be21c4f52eb0610cd1838b946aaca337e171591
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 29.0MB
        • SHA256 61416250ec143ba59674b1a866096cf5dcacf299f7f869ae82f1c83a34d7e464
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 28.6MB
        • SHA256 9b556d757c93e95c873c6ce4310f0087aa2dcd7fa5ef84accfa2f930c207b9e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 28.4MB
        • SHA256 fe5a04558287c3b03c09480bc031896198fc72743564f10bc2f77559085f7605
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 28.6MB
        • SHA256 a729ec388ee9163c93a5ad67487d8b21b93e3f232aa634fa0d7fe82eae30c64a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 28.4MB
        • SHA256 9d218d549c29d6916df9d9123338cf27132c05a6101a82df9479ae4ef6c9cf40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 28.3MB
        • SHA256 14afc420cc35f622b32ce1f2c8deb6823c76a1e70f18f091e37f0524b8ea1d0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 41.0MB
        • SHA256 5f6399ac18fd1e99c9b78f818cd37c170441093aa604e392c1336b080476fc9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 40.9MB
        • SHA256 08c61318a80a386a03b1fad409e013e7d7c935181269e5529f8550a605d48206
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 40.9MB
        • SHA256 b6fbad695a64ccfa880ac8cef493ebdc48020723db85a30eea0a832f540a4b72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 40.9MB
        • SHA256 71c75a3c52f3033412269d6a931e7ad2ed8aa45513fb6d9181e92ace8cef2253
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download