Overview

overview

8

Static

static

3

2026-07-22...wk.exe

windows10-2004-x64

8

2026-07-22...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    24s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/07/2026, 17:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-22_4d1b075f8275327a564eefbc786a94ec_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 25.7MB
  • Sample260722-wfhpha1bph
  • SHA256 79e1eca187963c8eee0906da28e225e1c162c6923b67c56d7c7291e44b6129dc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-22_4d1b075f8275327a564eefbc786a94ec_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-22_4d1b075f8275327a564eefbc786a94ec_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4732
  • C:\Users\Admin\AppData\Local\Temp\2026-07-22_4d1b075f8275327a564eefbc786a94ec_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-22_4d1b075f8275327a564eefbc786a94ec_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5008

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 25.8MB
        • SHA256 53a96b127e76fde3259eb63ba86a54070aca67166d295176fadfd24f90eb5eae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 55.5MB
        • SHA256 10cd36b6f180314830839c144133705ba89c7ca14a4091f96d88d9b9fa0e7e0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 51.8MB
        • SHA256 43d5aae60287f15b5bdecf7a04f6b2a4388b3dc5cc871876d5f453e1ac5ba0d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 52.6MB
        • SHA256 fef75e6ab4aaabad6c50b969a13cbcab5a1986e7f8f460c9ef8fe3fe08d6955a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 27.8MB
        • SHA256 9b2ccf678d56c93eeb5153e25ff80559397dd91dbd0a726d486b39160d44e858
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 51.5MB
        • SHA256 8ac091d36370047a9b74d7213ab0148a3a9b9310ca580787bb2488f9555ae36f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 42.3MB
        • SHA256 c69144f92923b366906fea07cae6058379c7511896611d03414b87ceb47fd5a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 49.3MB
        • SHA256 9fbe2fceccd290797838d7bbcfe88f70d53da7e08fd5004a4a34cc07e1ac0c12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 47.6MB
        • SHA256 97d16ff4cfd82ddd01da90e1e70c5471aef698a6bd44c0242a4aeabdd831e434
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 47.3MB
        • SHA256 f2c59db39f5b790e2a20fb2b1947e7189cf31b77f1dd50f428e97330752a67b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 44.3MB
        • SHA256 b9ac131f7550ddb0883395c9383ca7931ff4453545c15561b2e4e24efb1466a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 43.4MB
        • SHA256 d77398e07f7fa53938596b3eab49d5362357dc502f72435f08fe54cb5d8370d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 38.3MB
        • SHA256 6af420048dce1d720642d16f4b92bf0aa1f91c25b254a7f416a2808af76b0eed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 36.6MB
        • SHA256 02e88c7030bc160f0110ea9fae78204d571aee955727f52644d945281c953807
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 39.4MB
        • SHA256 ce6c24cda4551bfb287e695aba458d33b16b88bd6e0ce212851b3b35d89bf43a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 38.5MB
        • SHA256 d1f7b5c4a1bd984ced70846f56b952838c51990540df553c41329ba53eb3d098
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 38.2MB
        • SHA256 51874d3981e8b5c1ae086d7b40a9452b1038a13e982827c5d366064559250cca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 37.9MB
        • SHA256 1e8662bea64e9f0d03d04fff0fcfb9a520d7d6639ffe9bf10f7ee95d6c92c4ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 37.8MB
        • SHA256 85cc3899c9f7bef5200b5cd1f529fc22119dc588a2e4a228fa366f188e4ed62f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 33.9MB
        • SHA256 4e5a5a5d45a38417b9cf436527c3bb13dcf32a87736f9bbda18e5dc50ed188f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 37.5MB
        • SHA256 1a05e04893a4e744d8c684e1db0d3c566022471aa19a3487dfd15e61f9872f9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 37.4MB
        • SHA256 ba658ff9cfe11cf83e270e3f23916b3d32e157a2ab33e50222308e0f44b1de06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 37.3MB
        • SHA256 37eef924814ab7dfb97e5ea7683e6366a4058e089095603414f7663cc537fe72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 37.1MB
        • SHA256 f09da109b408270e77bac8d1b78460619f2fd7343349d0c7cc8bc2658f2f1b5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 37.0MB
        • SHA256 5b882b53539e9f18318390883fc6487f6a969861ed47592faf1a0d7fe793ea70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 33.2MB
        • SHA256 1f6c9635a654d94bb0085ea08f8f6be357cfa48520154c59710bef78f2e6a8f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 36.8MB
        • SHA256 4674d93110377ebc08f124ace356ece796fd7093e8d45dca26e84bd16a1d97cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 36.7MB
        • SHA256 fb8331fe115165cac185aaee1a3a0ef9810591ee812b2c2f07f61d1b7ee6cc71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 36.6MB
        • SHA256 7462c7bc6088f1ef401b1bdc55cff5f05bf7800593b1b0275d081b1607641f69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 36.5MB
        • SHA256 5f4e4652fc0b12b934874f1430a03d48515b35d27231cfad10ccf8c1b5fb3ae3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 36.4MB
        • SHA256 a34fe444214fdcef89004ca8d1317ccb4667e09086de95fb50b21d880ed1eeb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 36.3MB
        • SHA256 f0e030fa228670e202c343f519822593860f3ffe2bde75d863ff244c147bee67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 32.5MB
        • SHA256 973b7c6b7517bb3469ea3951766f6531a5b80a44e27dc54820ded1606d2cc788
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 36.1MB
        • SHA256 a0d12ff8e53eee6bb798f3ac1859c6d66cd2a28883198a2882ab2e36690b0e91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 35.9MB
        • SHA256 7173c04b0af6030dd4653d5161dee97f3bd9656e7db23cb657a6c1706e349e0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 35.8MB
        • SHA256 cc7b4ba1318a4e08a3e587e991f81e7baf88a37e03d953f4a96e55aa6155e9cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 35.6MB
        • SHA256 0f5362fe6fa6bca8c39da51a5df4d063d3b827968b1bd549fce5a9db3b5e61ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 35.2MB
        • SHA256 d1d6223225942add2bdba7365b6b682e880ca5be73cb3a4114be7f471873e332
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 35.1MB
        • SHA256 4010a1d361f6bd119631bd4ba8abc3599707e47142f426101d5b2d6b817b5c19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 31.2MB
        • SHA256 130074f043f4db0962c7d9246f186789ba65a62b72f8c80ed97d59c17e4daf41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 34.6MB
        • SHA256 b2d4f91d4fc8fef09afa42f45210dcdbb471a4c357bb1d7712549c577e3ff6de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 34.6MB
        • SHA256 028a1bae7518f20b536733c5a7f14ff4f6b53fbabb4686af6063645c5577a522
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 30.9MB
        • SHA256 4d4a81befbe53cc881b6156d71a899989b5524e362b58acbb24c46aed89d123b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 34.4MB
        • SHA256 f6f7fa9353a32090cfc1650633f1d35ade88647dbf4dd302d7d559014d32e5d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 34.3MB
        • SHA256 9dcd15a4d306d793612f2da2e10e2f16b5ecd7c8434486e0f624d3a6bd5770bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 51.6MB
        • SHA256 78782969f01f85c565850d4e2331695c035f85854beddae20be0d4e855e8a20d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 47.8MB
        • SHA256 f33009cee9180ede34c5b574e275f85c9b633d5898572de75165870e489fa7c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 49.9MB
        • SHA256 a22b5c9697636ee61dc9e64762433a80592cd44b0dc377954f8f179acebd86b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 45.6MB
        • SHA256 dcb02326f65b7be00b8b3cd79a0fa8b41c640016256ae0af60d1a799749f328f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download