Overview

overview

8

Static

static

3

2026-07-31...wk.exe

windows10-2004-x64

8

2026-07-31...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    52s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 23:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-31_71391ac9e191346416a53bc70e28353b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 35.6MB
  • Sample260731-3rhbfatape
  • SHA256 ce0b52e0d4a72b4c6bf8d3bb43b80ce83121debf0e63e3b5feb698a2646e203a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_71391ac9e191346416a53bc70e28353b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_71391ac9e191346416a53bc70e28353b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3200
  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_71391ac9e191346416a53bc70e28353b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-31_71391ac9e191346416a53bc70e28353b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4196

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 35.9MB
        • SHA256 727d3d3df5458d46d5c124d2afb3592e7ed060d27c67a1411027d974f6cc0183
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 36.0MB
        • SHA256 cb1907673c64d1fc556b1d8b5af8d23763323ff1ac54541cbb2196b449a5e535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 35.6MB
        • SHA256 ce0b52e0d4a72b4c6bf8d3bb43b80ce83121debf0e63e3b5feb698a2646e203a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 37.8MB
        • SHA256 d9b614947c4a6e620adbf2e1e63565e360f1faf1814dda9f219923887fc991b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 35.7MB
        • SHA256 f97845e0eda224ff247de0f48d4fdb3aaab0c22fc73f537c6f716e348b7c99af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 77.3MB
        • SHA256 c349f763a47ce6dd2ec6b2f7403078084d1baf0cc68bc19713b06fbb015b6b5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 73.0MB
        • SHA256 4e901788bbbcbe4596805da40603701dc091e73f34ec61e79c3a439410e1debc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 74.7MB
        • SHA256 97100db2438e6a21dbf9b460bca105f46a2176d988a8c83d0afa2a6ff990d00a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 73.5MB
        • SHA256 12b7337d1a89656dcec9635ccca4077f15feb8e43fd992f738734d2a45b022cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 73.1MB
        • SHA256 7b97e10e84344c0ac516031436ac5fb136d9a39fb454c74b8b58c6a484293364
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 74.3MB
        • SHA256 241bcdc6957e7e8438e0246ee763f72f82bdb417245e8c4d3755a5e9b40b62f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 71.3MB
        • SHA256 4dd100a0d58108e6583d800b1c858cac7a132dad8de6c6fd2f40b70091661cba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 71.3MB
        • SHA256 f26340b25ef5a22510b7e2f1a9930a0dfb27f1e594527e1b7d63783cc0714320
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 71.3MB
        • SHA256 aff5c6f90cf1e813619efdbe2ea3b97e073d21df49c4f2ce9a8518777e8be9e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 71.3MB
        • SHA256 1b218a86416ff417a40053f2618a3dad4e2de60e04e6ba78ea0dadb53ffd4bad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 71.3MB
        • SHA256 796d6f15f05dce0223b7d87a6d4254b047f4d9b73094921c76d2691083003786
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 71.3MB
        • SHA256 1c155ccc5601293b15a52af802c9996bf31ab6f3eb6e9692f5b696c71eb69f1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 71.3MB
        • SHA256 ea48cd2fecbce71638035db5cb19859373aaafed53d24a4e509435ae0a17152b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 71.3MB
        • SHA256 8a750be0e29de4211cfad232b2a3b5d4d3caf451972186d54a27b27d9d2f335f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 71.3MB
        • SHA256 41528015fc60d9689971c671ba2d53d2043ff9922ad311397c470dc0dab69942
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 71.3MB
        • SHA256 8a979599893b8f9a25fad3b5a43067a381567441537ed9076ff64d1dec83b8d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 71.3MB
        • SHA256 cbf4423766746c94c30f1f6612d95f2a825a79095fc375779878b1a8e5a8dad2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 71.3MB
        • SHA256 a9d56ba487b9bd741429ceec61828a60b60c4243018eb16fbc14e5e195e0c75d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 67.7MB
        • SHA256 80e966f6bcb965c903bb8f7e096781a01a234fb499c2019bde011da58c30f583
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 66.6MB
        • SHA256 9c9708f78a61c8eac4464a62454f357660464a5dc8475c3a4ca239e1beba7cb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 66.1MB
        • SHA256 549a855d1da68c6e1b0cdd1b6dd8f6087ecce1b79a55f3dc64fddf7ff53d438b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 64.2MB
        • SHA256 dabfb86645c852f9282d50fbfd1aecd1a54c22d5e3ead72d1ed1da8bfa11ca1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 71.4MB
        • SHA256 f07de31c5de7cf32664eeedda8c69f0e5d5d1e6d18feda65fbf97af4968a4252
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 35.7MB
        • SHA256 cef8d5d9f23a329dbe0f194ddbb07a8f93cc56ece235d5c5f687ca1b9189ca03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 71.3MB
        • SHA256 8ba8caf9990863198fbeb7e7ac2e83c84d5675abccaba5ada7fbbe0adb7960a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 71.3MB
        • SHA256 3694981208c5f80e41da08afca9fc4cc8b2b9b1ee874e2f57bdc3dc632100e4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download