Overview

overview

8

Static

static

3

2026-07-22...wk.exe

windows10-2004-x64

8

2026-07-22...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    24s
  • max time network
    139s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/07/2026, 18:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-22_15152deeb8057814d8d5b1ae956fb8e0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 22.6MB
  • Sample260722-wtx2ca1ere
  • SHA256 16e1062c646cd805544d41f037d913538872b3b3e2d1a5e67500c6b15b27bce4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-22_15152deeb8057814d8d5b1ae956fb8e0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-22_15152deeb8057814d8d5b1ae956fb8e0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3244
  • C:\Users\Admin\AppData\Local\Temp\2026-07-22_15152deeb8057814d8d5b1ae956fb8e0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-22_15152deeb8057814d8d5b1ae956fb8e0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2764

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 22.6MB
        • SHA256 d8f6c2590bf98b1193afbe1bb09c74e7394f79707cbd202e864b636e56357908
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 22.6MB
        • SHA256 16e1062c646cd805544d41f037d913538872b3b3e2d1a5e67500c6b15b27bce4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.7MB
        • SHA256 08fec16375e7aa3a9949da24fa7a8faa841d8726c595094f935885a5222c4683
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 45.3MB
        • SHA256 e8d55c9f9a7b6eb45fae87a0ba6628659b7da7dafde85bbde9476ca493eb0eb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 48.4MB
        • SHA256 e1eac181240e620d117a548b343fc713d47599069116416081c0a17e46c937fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 46.9MB
        • SHA256 f89b45e37962f8bf9b6906af08308d6b22b4ae62d31e3b9e3fffd1f167426072
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 48.6MB
        • SHA256 4c3d2790c6ba0d7c5672f16eef5dd4c6526f007f0c81dcab7096fe724a82ad4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 47.4MB
        • SHA256 d2b1ebd045d47a3ed9cdbdf5b225d539579386038f3704141de465bbbdfd0980
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.6MB
        • SHA256 a64b300e0d2759b30aeb1f772e31cf778c193a54f22335be842884420a6c476f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 45.2MB
        • SHA256 60c64c03d0dcb9b6f1883506f67a839d4f6ffb739cf1d20ba6ea86182bba27d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 45.2MB
        • SHA256 afbd5b48788d22bffc8014158eebf526082ce315ea2f66ef8851f940ee07d803
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 45.0MB
        • SHA256 7ff46cf16a7223d3a4322c1fc84c2affb7b469d00cd148fab9ecf85649f7ff72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 44.2MB
        • SHA256 5add84179b3071d931907a28315bf71343b4dd13cd038def1cfaac69f825607c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 43.8MB
        • SHA256 f5c408e6e2618c6e0b96773f68043a7e2613d30cd50b4ad1992f20bb98bc481c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.6MB
        • SHA256 1f41c0fce628a609a4b1b1e49ffc346348d7a956e77de0ebc18d0adb64e6c1e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 42.9MB
        • SHA256 4c23977356545264e27edb3cea60c8a3c3c4fd5ab468ce3887fd962a0afe6820
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 42.4MB
        • SHA256 d15cf289c7ef3e48e92deb2a30c28ad1ca0859450e4446c487d19d1b5ea41e92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 42.0MB
        • SHA256 0f6682c450316fb8b7fc0216f3171b74a84791e47dcb30d488fe039023f0bc48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 41.4MB
        • SHA256 96169de9b50eff0e15fc3d97d84196e44aa5bfe86f29a168f1f270e88d8889ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 40.2MB
        • SHA256 3970f57b35117c69e5c94f214baaf043eb260aad2d559548b6dabda902de66ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 39.6MB
        • SHA256 3851862570b15b33e8bee6069436713569aa70ac3567c8fcefba843122dabbde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 39.2MB
        • SHA256 764593a0243c6e0e7c96786a0e49b760535f0084a1ab2e17cc5f4c42e2b32830
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 38.2MB
        • SHA256 cc912bba410ffd1c9a832d7f52d663bc9562059c429520d7216123a168368ce6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 37.9MB
        • SHA256 422f96883d9410f925cd0199159a7df44777d8c85d782c5e790b5f8975aba239
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 37.9MB
        • SHA256 df617d7fbf5a286491b6c7716c4dc68e0aa5849ed38e37768d81b536045b2862
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 37.9MB
        • SHA256 0613d5fabe5fe0cfacc75ad0a57f04aadf98041e9c3be70f2fb023d9d8f04f67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 37.4MB
        • SHA256 1d2f783a2ecae889ae212e4a36632a4e8f39c10e02cb1890d2c505e841a1cb7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 37.1MB
        • SHA256 a933f8d58e9054a5f5ba3b75850dfd29d168653a9c80e653037e3eb7a8d64b9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 36.8MB
        • SHA256 bb565eb387a6865e8cd96a896de6173203a632f9b227aa12b37ba24839a214cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 36.7MB
        • SHA256 545925aabd1033f2f599f9592cdd4d88ef30899a64bae547d1845ee8fa55bfae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 36.6MB
        • SHA256 602cee333fecd857e4b4b13a06eb8ac0c7b86d374e28e4cb9b51ecffc9e66e59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 36.6MB
        • SHA256 1b979340a4c54d7440883f8dc56f22065abafef64b71e477d71c93268f0fb040
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 36.8MB
        • SHA256 0fce3cf5a9161349a36c7d95f59ee3c34c6fc9c89d21171c84006aeb40db2c40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 36.5MB
        • SHA256 0f929e14dc8f32c2cf69f28f0166f3e3c7242bd9ffd29c09938f82aeca003452
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 35.8MB
        • SHA256 03a5c24211bb1f52554c1d8a0c836c9f655bccbd3b32e4e21d774fca24a51921
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 35.6MB
        • SHA256 25c17e246bfa3494de0958094e4ed30d8c0ffd6a8032639c1fed489a695963ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 35.5MB
        • SHA256 9b759ed60a665955bf999807e4b14b797df1c513193a3746233ff7e5bcc0975f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 35.4MB
        • SHA256 2a4b30adbe3af06d81cd3f850d4c2ec96ab6f5204581146d2e8bf7c1c70957f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 35.2MB
        • SHA256 5e0f6401cf65d053927ae07e827d3f5bbf09f7cae5c7e986cc3b5b552d0ef876
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 35.3MB
        • SHA256 fd16ad30f95914eb80ac20ac4265f00a0508960c271347c640f0874262db4712
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 45.3MB
        • SHA256 28a6b84539bc65dff54231b659ea6066c6f56042e59e1c1f12cf9c2b5307b2c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 45.2MB
        • SHA256 cde9d1f563587ae35ab65f37412c14805b263f7bb82cd0e12fa881607789dce3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download