Overview

overview

8

Static

static

3

2026-07-20...wk.exe

windows10-2004-x64

8

2026-07-20...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    66s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 09:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_a35aba496657381285ba6f4ac6071105_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 46.1MB
  • Sample260720-k39kyscw4j
  • SHA256 1a19561e2ecbb8b508365e579074d01039b43ae90cf6adae99927c425a1028a1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_a35aba496657381285ba6f4ac6071105_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_a35aba496657381285ba6f4ac6071105_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4308
  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_a35aba496657381285ba6f4ac6071105_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-20_a35aba496657381285ba6f4ac6071105_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3336

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 46.4MB
        • SHA256 f6f92df7e1a0e61fa7657674b86fe92d52bcab3fed90ca462b4029998e17cd65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 92.2MB
        • SHA256 014aa5d97348572df9415bf21cb01640a2d4bfed048efec95e201836044614ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 87.9MB
        • SHA256 7b1db4392d7b4d621b67e70145fc4f185d171ba1324b89ffa4f42123c483354c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 48.2MB
        • SHA256 f5d5e0861a05738ea4efb2d8d3a385f7003b79baf89670804397acd46cf1c1ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 82.3MB
        • SHA256 28382dfc40004d228bef7ed12a759b51ea8d3c9335ce84b598f6406bbb009a38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 69.4MB
        • SHA256 841e06d4e1b72d3ee130e2aee3de6d64ab3c1f9d1008185c0e9e05dcb2f73f66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 70.1MB
        • SHA256 0fa47f28739fe74eb66fc589999a29612cff443513e45c3a735e3fcd599ce4e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 66.2MB
        • SHA256 f6e985bb29eca303dc131ac6c61fd2438002c5b6a29e56a8844c010ba29454e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 63.6MB
        • SHA256 7981593c605d2854bbdef001aeb7099cbd7fe4e6cd9f1e1dc9b35284797afa26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 57.3MB
        • SHA256 907b9f1e4f541d0ba761e41235593c483bd6e2f20b631be87c56cf9cd380be09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 58.4MB
        • SHA256 4bc17cad2242fe95efc2db62e3bada0aa39dbbb5567f025824c1d928cf1ca66f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 56.8MB
        • SHA256 d2597789f6699e0c01710a1ecc64b8db5ae567df52eb659bb4dc3b1e93c32b70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 49.8MB
        • SHA256 ddda3efb500068aca87255a71b993adbf9faf5832ef66499760ef5aebef8d955
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 48.2MB
        • SHA256 6f56bd9e1abb1fc394ba33fd8b0afb311bc710a41586b032d3e53852fe2cd157
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 47.4MB
        • SHA256 0533c972dc1cc1c237d47354568f8fa2a8742b033257d70454e36ab4abb3d167
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 45.3MB
        • SHA256 62d65cc6c29597f38143ff763aa8a7006fe9670df71c5862a3a3cfab61264beb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 44.4MB
        • SHA256 c39eafb7f91cb05d1b55336123e1ebe13b55fd1f7bd7b68d622600fa1bbc03f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 43.1MB
        • SHA256 608ff96f847ec90603fa87e88096248d5d769338adecb4fc62f40392681001eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 43.1MB
        • SHA256 08c77b1baab717ff530fb1d189b0dd908f2fffbf5985d571279c6c44cbf1d618
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 41.2MB
        • SHA256 03bbe64792285504a624c962b1677960ad2b915bddb8182d1ea96914c743a0cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 39.6MB
        • SHA256 e557f175967f2d48f73c3ce317e97608069942f121435f77b3c6b2f97a7251f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 37.7MB
        • SHA256 c68972fc2770a9b94c406f763870940edbc43f3a494a363cf61561f49aa78da4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 36.2MB
        • SHA256 d0d41b634117c1ccaf1b92a8931b73563190ba77befa7b2bd3817303b723bf40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 34.8MB
        • SHA256 955425fc55a4bd12b339fd2af90a041ec70eccd48e5eaad0c09fcff002aa8892
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 34.1MB
        • SHA256 8049c2912e7d399b722df72137a117270bdb8ab46d9b61479e0bdbbdbfdc51f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 32.8MB
        • SHA256 0ad275cef6162b0ebf15c1c3d5873a0da28d3abe237baf217a970a6c1adb4c61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 32.9MB
        • SHA256 b37b751e80effb4cb934097917823214700af9013a9701de1c5b8f4378308840
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 32.4MB
        • SHA256 51cdc474aee67b73a54d58fdb86375d15cb6e45dbb1a5d63ce9e96e84d84396e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 30.2MB
        • SHA256 b88dab91d30878a6f257bc39f8167e8c45fb5742273b2d526f0f8ac5def4768f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.7MB
        • SHA256 28f122d877b92676f9af71d55d0e86f55f849ede20b21a192f7c14cca8a678a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.9MB
        • SHA256 b5e3d62f6cc794e9502334b04bb63309075b3220ec2ac1133064565bd0e370af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.4MB
        • SHA256 de7cfa6bbb1aec589a40e7c89ade48066c375e7a63844cdc4241d8d1cde985db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 28.2MB
        • SHA256 76ebadd30b14b310ac828f5f634dd4749614c8d95b6513c7e0c59f4754e3830e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 27.0MB
        • SHA256 cfde48e77aff73b49208cf10fa6eed35360e811207133cf17a72c6c8a9fb23d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 26.7MB
        • SHA256 a7ee306ae4d0e53493c09df18b753c3310a562d79f5435303c8f691207f7d313
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 25.7MB
        • SHA256 386c0ee0e4ab1adba7de1f8c3d8a282c0ccd09822ef7006f11998e2c010abc70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 25.1MB
        • SHA256 3ebb7be2c64ed6ed46ccf29027d274bfd12be855804cd29cb1b70e7d378903d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 64KB
        • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 80.0MB
        • SHA256 27d2e68ed42e108cb874384c981cab0e6478eb0c8ac20d4299bbcf8734ca8e3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 73.9MB
        • SHA256 73b28425270551ed969c6fc84747f86ea710baccdd969767e4af8bf915ac98b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 71.8MB
        • SHA256 8064a5b2f85a1abac7b9a8963e18da3f78df7a41b7fafdaf9451ede877208bbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 71.1MB
        • SHA256 fcdee8e00a8b56bbc79636e1d7c5a81bb1f5d0e66c602b7828d2ce40f4deafe3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download