Overview

overview

8

Static

static

3

2026-07-18...wk.exe

windows10-2004-x64

8

2026-07-18...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    22s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 08:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_0a9745aa192ba1f30bb72cd9c5f13967_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 19.6MB
  • Sample260718-kv2kdaew6l
  • SHA256 86358662b9a0639574c868315ac464693b55e6ff5b2d69e85ce282d8a6d79941
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_0a9745aa192ba1f30bb72cd9c5f13967_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-18_0a9745aa192ba1f30bb72cd9c5f13967_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5996
  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_0a9745aa192ba1f30bb72cd9c5f13967_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-18_0a9745aa192ba1f30bb72cd9c5f13967_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1924

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 19.9MB
        • SHA256 40e8bc656dd14dbe8ed0ea3c5b13f9a4d501c1cdae4c178c6b5a3cdf70b27edf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 39.2MB
        • SHA256 3ec39c17f6a360a0e80029ed2d6822f8a034e52238fc7a498ad79a2950cd0721
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 43.3MB
        • SHA256 c5e416e817baea0ee1a63e1e2624bed143f49a694830a708834c891b7bc81c18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 39.5MB
        • SHA256 adb8e163323e6c2cbce18199b3b69ceb90f29de5626fe7eedf708c797420038f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 52.8MB
        • SHA256 08e529367c230c5a24585f398bb4665554ef58faa45b1262c0d2aeb2914012a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 21.7MB
        • SHA256 15a658730d69df227c6a04d02d268f7dc217cd19ec90063518d5a9788d1a30f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 39.3MB
        • SHA256 b86b936b6b0d86d4284c079bf68c28afd4902c5945ba58520b6e6ecfe92cabf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ExitResolve.asp
        • Path C:\Program Files\ExitResolve.asp
        • Size 39.9MB
        • SHA256 1c8c390fb998eddd50e6114e710b4b487c384b96850c21c73315ec512aa49c74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ExportRequest.exe
        • Path C:\Program Files\ExportRequest.exe
        • Size 39.8MB
        • SHA256 7183e87edf75906bfb0e3b0b767741b18b80a985cc62f4fad4a0158f3f4122b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 44.9MB
        • SHA256 86c55c0d573bf7d0667dcd2e4d96974166fa9ebaf071b8ac44ed567d440b5e84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 40.9MB
        • SHA256 9eb1d6f264706d3a0db9481cba9a657e218d0dce08795114fcaafeb4fb30da68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 42.7MB
        • SHA256 6049ef318c745ac3b867d9e80d4a4e906e16282718399084edc51fcfeba068fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 41.4MB
        • SHA256 368f0cf4c1debca071229385785293d9ca4b1665376e8aeeb80b8454bd7df1c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 40.8MB
        • SHA256 20575bff8001001760039c0ec3f9c39008c1418fac3491e97a7427076e25dfdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 41.0MB
        • SHA256 531e5f217d5a8d98c9e81c2f14ed103cfbd9347051377cc5ce15384c8881c21d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 192KB
        • SHA256 cc71df767f30aa32b4d730d3c0244896e3d45eb216f18568c46371d93640cac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 40.6MB
        • SHA256 b0052b6bdfd266ecf96528b94c288eac16eda24bf678bcfcf78f0f8636b450d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 39.2MB
        • SHA256 e7d6e5125008a7eb78ec8fe9a12b26c33a82d983beece3071a46e83084e0820f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 38.9MB
        • SHA256 4e2892aa23f588356d24cf467563c8c9ff715230bc745da51d25a2c9d1fdd0df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 37.1MB
        • SHA256 04bcd3f5c6f3706c95fac65e4ad4746e3b2cf8021790a8a91f0b1cedbca88f52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 35.1MB
        • SHA256 690476a93525b6484bc31062e2c907fc17fb5371413d8ad4c1764410404dfca6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 37.4MB
        • SHA256 271952182f1763d1c6b982dd5cbbfc22d85be24e919308a9a29539fa608ebda5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 32.8MB
        • SHA256 286e351b2239b2ed78d76fc5d6f690a2226e1d2a907324c7200d952bf77519da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 32.5MB
        • SHA256 a0c630695afc81ce7ac788ccd44fcd436e3c038c8c79feceafcd5537ac986566
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 31.9MB
        • SHA256 f264494764f1df8b3f4f6edd5cc678cc0c6a505839f0e4822afecfe72f0eb8e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 34.9MB
        • SHA256 df5f9aecbabf5dc07ce815f67909d51e8cf63ab55268db633e69a98c45725dc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 35.2MB
        • SHA256 66aedc046166317f4b8208bbf3747ca882d82d3dd8e4dffe04c7236fcd63a641
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 35.0MB
        • SHA256 977904f5581596074b2139269117a0421259d072495cb90d5fdebe09f9113dbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 34.6MB
        • SHA256 cf7457ddbee0413e22d756fab253970b924a9e980c2bd7fe1098ae5f6295534c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 27.2MB
        • SHA256 3c7981182565bce399be14c01013b24301d5bce71c0b315d457195f1e593aec5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 34.4MB
        • SHA256 af5b625e9101c719753e4583c8d65b089c97d23b4599a87c073508a7dff94535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 34.3MB
        • SHA256 83b1d8d2fa895e97da2d85ff66cb88f42df6a3c1d1acc6723eea71571256fd27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 27.8MB
        • SHA256 880d48fa1e22e09c6f625fb53814b4a36548cb6566eb8ade81bee45a64184f15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.6MB
        • SHA256 c43217186223d4c80d2a51319e971d2d6d164062429c68a85ce0d78536345658
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 33.9MB
        • SHA256 9344336052bbe2a3bd6787003cbefe8cfe84c2d137708817b3797c918dc70e06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 34.1MB
        • SHA256 ae57e2544f969f97b9a497dab5ebe5b9f1251b4fdae7533e1acd674173928f7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.2MB
        • SHA256 5194141d904cff7e159c490b311201ba9692f6bfda308649e83bd171b3fa9688
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 33.7MB
        • SHA256 da1dfbd9983ffe5c909540637ba0a86b9a1dbce7ba081725ea926fa84eaaab92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.6MB
        • SHA256 0a686f71526df0ec557abc606a5d12d28a10a9a99097a4e7094c4552cbe25ca2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 33.1MB
        • SHA256 36a551f230147c9e2a82151fe1e14a9685e3fa62c6501e82b506a4917ce9fec2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 33.3MB
        • SHA256 0ca9ca952b80e6d8eef92898d9c4e72d0f89802891bff1fec42636bf22a30e41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 32.9MB
        • SHA256 bb51e408c8f587ecfebe6814aa77ca1d6421f31c919bd0a0548c91b91d688062
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 28.5MB
        • SHA256 6a8e04d47b34f8ba3d9466bb231320c6a623b8b81eb9ebec11ec18b963d65bc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 32.7MB
        • SHA256 7a0c23d717fce8e8ad20249e924ea856f990b45660909e7577e92183babd5edb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 32.2MB
        • SHA256 2ce999d9bcec50079d851456f8f6bbd734b965cb102cfed8711b0a530223bcb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 32.3MB
        • SHA256 65e45866b1d491d9d96cf02909f185084413543364f521ff57be8154dcc0d15e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 32.1MB
        • SHA256 86f19e5db822f58afc3b75eda87292510b465099439dbd3391f91bdef9c41b6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 32.1MB
        • SHA256 c97e1bb896c6e43b778c5daca098f0473fd65cabad2b56dc9702728272f40553
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 31.4MB
        • SHA256 63b7e06dcb62035ecf1ccc2c46fcb4af2e2baa69232cd9ed216a707774a79082
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 31.6MB
        • SHA256 973f912906c4fda80e31b864f5d2127ce98a3ba53d7eedb6232ba0d5fbd2c6a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 31.9MB
        • SHA256 1118a6d627ee98a6c2f4401b89505525a2767e5a0b9fc49758b571275f4b5fb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 31.6MB
        • SHA256 4e8fd5cbb4cab2930ca7cb631a4f546511746e8b1e4b58636e0044bf97f6cd6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 31.7MB
        • SHA256 a32c2e3541daffe7beaec6b73003762e412182cdd2faeec02483053a4336f7bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 39.3MB
        • SHA256 aeecf3b550788bafcd0bb46191e970ed8fede7508b31b2efd0b9f0e9e06be740
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 256KB
        • SHA256 a88ab2eab13680012502e10692ec5c6fb70e333b6df630e671ad53aaa93b2f63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 39.3MB
        • SHA256 183ce755d494b4060c6783da50cd8ac2e8ddbcb13abb380f3d287c4626d60d78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 39.3MB
        • SHA256 20410478da6fabd7c1c1e9efa2ea29afced32074e312d5a8e2d5dcc9740dcc1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1924-21-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5996-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5996-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download