Overview

overview

8

Static

static

3

2026-07-30...wk.exe

windows10-2004-x64

8

2026-07-30...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/07/2026, 05:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_5b2dde37e65acea4a7d0b676c2cd4680_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 29.3MB
  • Sample260730-ga8ams1bme
  • SHA256 6fa996913586340ce252ed459932490dca29d50639aff37fe46215688b544ef5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_5b2dde37e65acea4a7d0b676c2cd4680_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_5b2dde37e65acea4a7d0b676c2cd4680_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3428
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_5b2dde37e65acea4a7d0b676c2cd4680_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_5b2dde37e65acea4a7d0b676c2cd4680_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3956

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 30.0MB
        • SHA256 6b06e38d719407411981bed36bc96e31c0eae079fa4deffabf26917d31fac632
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 64.7MB
        • SHA256 8816885c7585c2b343e03fcb3d190b8770b88ef069c196149c5cba19a7129413
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 60.3MB
        • SHA256 82a92e13954937d93ca7acb8293588bbde202dea6d0f828a2eb75fd696741a84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 62.1MB
        • SHA256 0f6ac0e888619334304289876e6f307fc4a793bb5e236bae80beb727595f8279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 60.9MB
        • SHA256 11943e16e436ad9d41338c3d22d88ed193197ec0fce08710375557d2e64b3bad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 60.2MB
        • SHA256 a33f1143f7ac83aede6289f68a8d63b152009c2c34000f894e8403bf64ec1091
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 60.5MB
        • SHA256 a6b04a1d452f9149b33f6e99978254641f9cef58dd13b417093563128d7f33c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 61.7MB
        • SHA256 da8cab0b69051d32e3e79c0a6b9284afdc07e853d6a35294dd578c8b44ec86c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 60.0MB
        • SHA256 41ef85a23da39c26a3926380a85cfc1f45b3bfdb39297f65cf3cbf8f279f742a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 58.6MB
        • SHA256 7ad8ad987c8cc833a138f0fb0b8221758a5d56be05b2ac05e5545436ae6b9379
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 58.6MB
        • SHA256 e3afbef0ee294dc6b2f1262d82eea61f4fdecf003f55b7233e0a05e9347e7c11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 58.6MB
        • SHA256 6064aaecf6d30370f5040c6e1c07777947226d9f95dfe933fd09992717962cfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 58.6MB
        • SHA256 c4c966b260d590843f71c8e1f3d5d10134ca16f2501d1edd08aa289bdf4e5f45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 58.6MB
        • SHA256 2d7d6cbba530366573104526818c7e17c5fdd68144c208a4a8253b3695d42dea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 59.1MB
        • SHA256 ac04a252b14c97b846e3da12ccb77b3a99d4d21afc367da4dedbe434cb76f7a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 58.6MB
        • SHA256 299e137b5024ed50ddf4bece1dea036e3487591b4e8699ea2814661e224c761f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 58.6MB
        • SHA256 1b7e4bb060022b46b58b27b62bc4bc25a0e506832df4cda46fd493ad254c2731
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 58.6MB
        • SHA256 c495105cde31489446c92ad34fdb26fe3c25c4f7a60e4aafd1522ae9a7db4c78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.3MB
        • SHA256 65ee62cc29e5fff08881092ebc8955b6daa31d49417a9e29e121a7561c899c9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.3MB
        • SHA256 babe104da1c75b1f8909ec112bb51eb21c7d293ff1e348cc1db452f8585c5b9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.3MB
        • SHA256 7ac2a756172317326f279b37dd25f22d532cb4d638ff10309d72966b1c7c4a39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 58.6MB
        • SHA256 c525dfff5760ab2f2f4b886b74590f914ea263749e861d07934d85a7ba963884
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 58.6MB
        • SHA256 96fde19c36c9dae314f9c91513dcaa2c126e5e59102e4aa0bcdf45479a5a78b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 58.6MB
        • SHA256 cfed8ce8e716c8465e5c3b3a5e6902c3ce2e93e2a9554130b09230027af91fa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 58.6MB
        • SHA256 bff6dbbbfaea8806259aa545f1b2f6130b1e7bf90e64153ca4c71c484a3a0ab2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 58.6MB
        • SHA256 c01eabc4a6e76d910c4922eba3b4d14af9c3fb47ceecb1c7c501c074e8d3c320
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 58.6MB
        • SHA256 3e138ca99926c5ba5bf3a69429078fdb2257eb49a3d7014c74332ddaeca74535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 58.6MB
        • SHA256 3dffeca44b1ea5da20c0894ecb9f428c8ad9349e98eb17fc3fece086907e4dd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 50.4MB
        • SHA256 e9109dc28876bae1f1c896e9f883878b538dd29db2c1fa5d665b7f3a99d0b346
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 42.4MB
        • SHA256 f3760165880755c42012ada3cebd3ff9ac651dbc8014081b700fd5ad25d27e8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 21.7MB
        • SHA256 1beebffb00c22e242779f39a2f551cd27bb0b9c078bcef5e37114712acee0d9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 38.1MB
        • SHA256 34ad9e4fb6c66f4cf460f63a8f3f639fd216db5a6173fa1f444f2afd44e0fd88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 24.1MB
        • SHA256 4d6bf2587a2095fdfc6f969483dc4fae6619883d5218f0e2801f87ebe1f160dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 10.5MB
        • SHA256 18c4db54da4fd7e112b6ac2aa0bad66a46dc91485d339a2def1d6cd43bc0fb89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 7.5MB
        • SHA256 78ec6961c61677bf107fc412c57c101d2697cb88afeb2042f03c96d427876056
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 6.5MB
        • SHA256 7ee5279b53e65ec77cb6e21e10d6d58ce211c1b2fb75a4df73a0f09686a9a0fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 29.4MB
        • SHA256 387288863bc6f22a7e3afa092350674857201ba2a061bd1a856140c30b73712a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 29.3MB
        • SHA256 6fa996913586340ce252ed459932490dca29d50639aff37fe46215688b544ef5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3428-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3428-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3956-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3956-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download