Overview

overview

8

Static

static

3

2026-07-22...wk.exe

windows10-2004-x64

8

2026-07-22...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    34s
  • max time network
    123s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/07/2026, 18:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-22_27e5d9f21158326ecd89596ccca3c2da_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 20.1MB
  • Sample260722-wpmd2sem5v
  • SHA256 70054294e667af70f92e96b791ceb509ec231e35ef8b5b834c079d96305cde20
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-22_27e5d9f21158326ecd89596ccca3c2da_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-22_27e5d9f21158326ecd89596ccca3c2da_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1596
  • C:\Users\Admin\AppData\Local\Temp\2026-07-22_27e5d9f21158326ecd89596ccca3c2da_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-22_27e5d9f21158326ecd89596ccca3c2da_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5444

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 20.7MB
        • SHA256 a402b72fcf889b7732d8ce58c4fcdd62851a8f0c4ea05dca2254af74cc604f6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 20.1MB
        • SHA256 70054294e667af70f92e96b791ceb509ec231e35ef8b5b834c079d96305cde20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 40.3MB
        • SHA256 894663b26236927bd504fd47ac4d59cd2d5a49120f600194ecdeca8637512cb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 40.5MB
        • SHA256 17559e834b63da43502715e4469f983d381023eaa399fd825b32c63800817b84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 40.3MB
        • SHA256 73579f7de04c732eeaa19c2dcbde4cfc1e6638be0ed4431eecae7177d13c4bb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 44.4MB
        • SHA256 f064c72c0ab886b12c048f85098c5f2f810922fd334bb967793e9bad5b41fa1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 43.7MB
        • SHA256 5f5d4b35fb114dbfb249aba514ffc4f05e96a5e6a6e21f412884d172c871f6bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 42.4MB
        • SHA256 1024ebeffa062101d9ed0101c9520b81c14a925545c423235a5250eaed447d8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 40.3MB
        • SHA256 016bd1418d1b5ee9dc79f6e6e94c71286316cbce7a69fa9875dea2be5b0f4d7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ConvertToInitialize.exe
        • Path C:\Program Files\ConvertToInitialize.exe
        • Size 40.7MB
        • SHA256 06233b29428edeff14c2f9862c3d1833fc3a64c0056638ce9a296daf742ddfc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 38.3MB
        • SHA256 9204a46f9879c4d366a70d0cfab0f07165b44f640e9d078834e4b16e4ea87957
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 40.2MB
        • SHA256 20d1051b53ad4cf3531be1bd78fa1d78cb29ea25f05bef7f6b31c84a20b68956
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 38.8MB
        • SHA256 9ce78014dee13f98daee5e0bfaacc4929f27ff5414185cbe08f47097a28aa457
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 36.9MB
        • SHA256 72a02b5a09bea1538ceb751ade45a2d54ca8dc93caaab1af5410ef4a1fb23dd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 33.8MB
        • SHA256 c0758a74d68c81487414970d95037d46ded2e869c11472e83674f3a74921ed59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 35.4MB
        • SHA256 dc14a845bce9bd99359e882feea032b9d3cd4fbcdf037de51fdc09c5943d87ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 29.8MB
        • SHA256 3138b357d71c39dd3a71226e60d9777c203672ce5d9354c252aba40ec71bdf06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 35.1MB
        • SHA256 66ce455b1e537c12e157bbf2ac35dd90798f44b98050779b0d103254283e01dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 33.4MB
        • SHA256 4aa32fffb4a402db57d1d90dc9e1e5958e8652b1b6c90d3fd13071b729fb5e65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 34.2MB
        • SHA256 ef4cdc7d10c85ef08f57beb390fdc203bdf7b5d528cca1f673f2aebab7fcd048
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 33.9MB
        • SHA256 ee98d579ff0c7db6588b8f08b6d6cdcbd28558a8f656875d5cd55bd50078484d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 29.9MB
        • SHA256 bd441adbe39d16009803e6c1df949a5c76f3e9413b40f79e8688bb0486470225
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 33.8MB
        • SHA256 d6605d79747614c54b62cea7c491af35d0f2ff15cb161dea553b591ae64798a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 33.4MB
        • SHA256 7be94c0b0708de31d0314abf81b15da8301d7d0444517ebf572f338a994659ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 33.2MB
        • SHA256 8d4618423e04eee9762bd557675072c026a11e7842c6627da9fadda8cacfb597
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 33.0MB
        • SHA256 03b2b2c6263991a51da95f43febbcc962016df91d6e6f0c3ccafb599741a8803
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 29.4MB
        • SHA256 b2d9eaa8f3b58c3a6b3315de90661b62e57c8543c51369e307b247229821833f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 33.6MB
        • SHA256 505807e36aac5199094fb70069284f25d8fefd6f6ec967462a2ab5d84a47091a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 33.5MB
        • SHA256 9cf0176e71df57e2af5976c56ec6a36ef6945ae7a57428cf64fda1c2b3670322
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 32.8MB
        • SHA256 d3e9e1e6197748ac2b59d5dbbe7d9f2977e13c7eef05e6114d5665df86d002c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 33.9MB
        • SHA256 c6b1ef5f847e49a4d1ff48e998a3d68ebd7c1b4abf80d51da0d082e17d8e8384
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 33.3MB
        • SHA256 775d1aaac6cf3b3164215d97381623c3e18fab19a203d8c4ce0c58ccf351892e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 33.1MB
        • SHA256 7348b56be04fdd64545240f2adbe45b254774b80ddd28ddce15bf2f7ac406403
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 32.3MB
        • SHA256 9e21706db1a746c1c46a7ec67bb78f5339c5f044572a24ef8f41cc5e8ad40cde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 32.5MB
        • SHA256 a30847b4b43c1b9bfb268380c1b4ff621776f80922841674c4126a819e9a5e11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 33.2MB
        • SHA256 4c2c5977aabf2168a28aaabbfbfaef57d1ad821aef8b759fccd9c7c9654f6946
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 33.0MB
        • SHA256 79c4b6385aa3786003c186ff5917c26102dd2898ab9b6ae2c34121fd51ad2a34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 28.8MB
        • SHA256 cb4a2bc913df89ccf2c48e705367c4e869318d62b80625fbeeadbc1ba842c106
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 31.9MB
        • SHA256 334b690129bff1d792ad89c33e91dad89ddfbe594996e8282e478e112666f1b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 32.6MB
        • SHA256 72e5524c67e6818505c94fea50f8006126ed7200ca063e6a6eb8ed1443452cf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 33.6MB
        • SHA256 99587535b2363634b7789c276a7d0cbe365fd2735fec7d8a934c1b5da512c6db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 28.8MB
        • SHA256 c7de422ac6d3a6df3583d4fd726e467c558fb687d170a41bcd391a0d30b327ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 28.1MB
        • SHA256 30dd164f539cb579336614d12137d52de6cf161e53b67b56deb7c9ca1d06d553
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 32.2MB
        • SHA256 95f3073f6dcdda9452380a5d32fff186c0d3ffb08853e89a2484c01d01454f18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 32.4MB
        • SHA256 a8ce4541254d5086513009c2a003f839cbdf0adef209b9886358679e5e4f7ea1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 28.1MB
        • SHA256 7b5560d3a2bcc95cb990e5691c6f76f555303985f4a7713f86d03bc48d7ef508
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 40.4MB
        • SHA256 44d4514d325f9e449599983bfa8755222676af836f25c5beb697c2a5aa077603
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 40.3MB
        • SHA256 0ed8e8435b3956031266e441ecd82713edf190baa580c8137b578c640dcdcfa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 40.3MB
        • SHA256 b1519503caedb71116eb701ffebf97e4c7a7122337e4e9d68515c2167330a3fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 40.3MB
        • SHA256 edb3a1361300fe0cd06c614bbe293d44d473122d658eecebdd94c95cb41b5a2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download