Overview

overview

8

Static

static

3

2026-07-31...wk.exe

windows10-2004-x64

8

2026-07-31...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    31/07/2026, 23:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-31_a98168f231826067eb30dff07dbae6ab_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 40.4MB
  • Sample260731-3eckesszhy
  • SHA256 886f29e178ac0fe3f8ff019fe8ef701516e8b6a2808a6e98c1fb5006c47165aa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_a98168f231826067eb30dff07dbae6ab_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_a98168f231826067eb30dff07dbae6ab_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5032
  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_a98168f231826067eb30dff07dbae6ab_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-31_a98168f231826067eb30dff07dbae6ab_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2976

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 41.4MB
        • SHA256 a2188b973f723f4d3b678d020e20d99e154c811df16bc1d18db37b1c978847c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 80.9MB
        • SHA256 46f2ab6f5bacfcb0e2bfced9811655718d4027bf9a8919fab911a7dba9d0f053
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 81.1MB
        • SHA256 d815f148b284998a0900a5915c84f3b4a0ca2834e038ffb266974f34d1f56312
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 80.9MB
        • SHA256 d68fad36b3ed852a7ff0e1387346231d682478ca69b6b948036646500009cb8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 85.0MB
        • SHA256 aff5303fa2dae2c64ac98ee379ae7df5eb34e06c8b3280fb32921a128576a70f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 81.2MB
        • SHA256 5f727f48faa20ff27c7c50055c466c99bb40e2745825364709bc37ccfed0cc14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 83.0MB
        • SHA256 5afc686202aa175a7caa8a770e5a0f9b2c835a06f430ee3de8980907529e6ac5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 81.0MB
        • SHA256 6653c06cc615aa1254442a71a03fcf5d6f4805a8a9f6d8c5d1a69343d0cf7ef3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 86.9MB
        • SHA256 e2e2d566e16430b279b054a0e443cfccfab619f86fe42f12a8e68569f1b98c89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 82.6MB
        • SHA256 7c93099706f6348405f6dbac781a9257526d68a4e37132840287ba4fcafa39d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 84.3MB
        • SHA256 756188c45ddf10bca2cef37cf0b90e2bbd45528065a204d9ef1ea1c4f9c39e6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 82.5MB
        • SHA256 97a6fff1e44b3dd4e5aad0e7e51cad18a9916ba7333e19d8defb79a19da720a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 82.7MB
        • SHA256 e754746668f27cfa5fd189de6ef0e556d3e18e624398da9c5d73e01a4bde19a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 83.9MB
        • SHA256 67a72ca74ddc46c0f133afafac1c1df23e93f258410a07ef082570e65e81f427
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 82.3MB
        • SHA256 6eef1b04cdfaaccff0d6073a094afd8723bc09313a9034e6866acbc34e2851c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 72.4MB
        • SHA256 c643c58aad02c80593649cbea1fa3daa1416924f8e3a427d17e6d0624345e664
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 73.8MB
        • SHA256 1c4d86fb8df5c13bb8af90a82e497352c3c033364d5a379fb3effb34e53b8446
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 64.0MB
        • SHA256 16c51876d18646d3649a6431c836285b71089242a75010ae915d0488c6ab2739
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 33.6MB
        • SHA256 c9f57013f3006bcecc05e47b449d93fa5aed6f45d390bdcfc471da1e5ec81725
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 20.1MB
        • SHA256 7e1a4e10721f11c8ecad18bd5a6b06da7dabd36e7ba958bb4fb069258e2a0f2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 13.1MB
        • SHA256 656e6157627117a27027b423dc9d5ea68d3ca47e106dc832fdb3d18c5b9a1bb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 192KB
        • SHA256 cc71df767f30aa32b4d730d3c0244896e3d45eb216f18568c46371d93640cac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 81.0MB
        • SHA256 3d3b8bc48517a771de7b05242f4fbd3eb9b9b13ac2842c5777bb73e246f2f020
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 80.9MB
        • SHA256 e6d1b517fc1e7b09958b6ba254974e1a9de69adc8d2e010b659893f413b055be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 80.9MB
        • SHA256 bfb9b5ada4db4b51f068166501fadc5420e3edaf6b41bb87042dc79c06e16a98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 80.9MB
        • SHA256 167f3a1f612012d618cfb577ee2aeab108bd2a74a28515beadb3fe3d1bf392d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 40.4MB
        • SHA256 886f29e178ac0fe3f8ff019fe8ef701516e8b6a2808a6e98c1fb5006c47165aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2976-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2976-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5032-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5032-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download