Overview

overview

8

Static

static

3

2026-07-31...wk.exe

windows10-2004-x64

8

2026-07-31...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    69s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    31/07/2026, 23:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 23.4MB
  • Sample260731-3vn86abj21
  • SHA256 e5d59c4f6dddebe55097fa315a252d42c72e0fe61e698f99649e709507ae4f50
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1416
  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2320

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 24.1MB
        • SHA256 3ac70a0ba3d6882eb6cc3e5126d5a9836baa85eb309f8f979a09799affbdba17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 53.0MB
        • SHA256 2e7138d77f3d9b12a4b41b4f5d01345a566af14a1d912fcd3b1767f858bf9f8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 49.2MB
        • SHA256 7317cd345804bac3481078d84e152b08956b8306a4e6d8fe6204995cca419741
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 48.5MB
        • SHA256 a5178d2cb3a8ce7807e67e80084b140c875241c49fceaa4b258f7f61bfada2b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 48.8MB
        • SHA256 adabc84e1d27529e0bb89b2424a2ee20500a434b3099d643e8781591a66eb8f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 50.0MB
        • SHA256 2c92c39be1354ac25a92f0ad1a152e263a69e89a6ff8e71661e31ccf682865d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 48.3MB
        • SHA256 d41d7c0743d25c15ede87e24f6b3ff5106522ec0b94acf527f230abf804fd030
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 46.9MB
        • SHA256 af11f022bc641c185398ea166bdde81a0f7a7fefb48cdd5ec4ae17d865b4a343
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 46.9MB
        • SHA256 79814858b3476fc8cb6a8d5ad73aa8b36491d32134dd7a815e0d5e6fb32ec6bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 46.9MB
        • SHA256 9293ba03ee636fbc65517a472669bc251bb6a880e250e4d58ded608efa11982e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 46.9MB
        • SHA256 55031411a6d613dd49fbcc434aa702f9c7d9e4c17ddb02e7c4a1062598d9e44b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 46.9MB
        • SHA256 e09367930b38b9a6b36e056db707a1c3c8ee73c014cf271c4e2c83db5b9fbd85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 47.2MB
        • SHA256 1f531349176437a60eb71bbdd8fc0a44d5f108a143454aaa99ab0c3953827268
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 46.8MB
        • SHA256 d80d4dd4b2d15e030280f4e2056ab20421d1f944330c2abd930103ff651333c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 42.6MB
        • SHA256 8c1dff4dacbbb71c7da97694169597ec161d95af0f2d284f3f98c1dca1cc0710
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 41.8MB
        • SHA256 702d5bcefc1d51728d77315a6f2c2fe440c79ef33c1892d147d4a8d23d0fbf69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 40.6MB
        • SHA256 53e7722db5c690e2f4674cadb5ce1cb32b096facd63e1cfdb02fe86d52426175
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 42.0MB
        • SHA256 72163595be570a24c1cccc1d07248c12e3fb6a24cb126b308d3e6036b4cbeb97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 41.8MB
        • SHA256 3727195fae1c45216c535a653bcd062da6e978f17a416c468110d7f205557b77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 40.9MB
        • SHA256 83ff238bd3240e5884a686d7dd5d65c16a99d86933168bb2641c29786043e994
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 39.3MB
        • SHA256 6f40ee494d58dfc6d4b7a19c265ffa88936e859c5789de8f001c06d597780851
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 39.9MB
        • SHA256 50e6de5f6d2a754c81aaf372f1b787ad2dfb95a4c864e3664834c134298c1dfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 39.2MB
        • SHA256 1e4c9043858a6ea03e4de421abcffad33e21fc0b8e4def9ab78c029047490c6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 38.9MB
        • SHA256 bb6f7c122b6cb929416365c1d8719b43628fb9d06c29cacd5c95fefee125b4e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 38.1MB
        • SHA256 8d614e4e0c3cfee42233ee43376f26cadb76a1cb83d5ab5b0a10ee6d0e4d5b0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 37.6MB
        • SHA256 4ff88d4cee90d090051d2c9f0c3a255a2bd33b601f29ab891ff7a0fdea28dbf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 36.9MB
        • SHA256 7eabbb1a180549fb89a313bcc92402f57c96c676fc7186cf91caa790dad81601
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 38.6MB
        • SHA256 fa25d5b3182a1feba0b523de53fe32907d4caadeb5fbed9e1eccdc6d5594239c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 36.6MB
        • SHA256 564c2925b47e80ee045fcfeff889c3e014d4c79025cd288d638893b59e420699
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 37.3MB
        • SHA256 5af3463f58afeb73e220823d4ec487e772cab64af2c8821a6a49c38d182f9300
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 36.5MB
        • SHA256 06a3efdf78a6fe3b641b798625bfd5b285ea321e3950ddb2b09aa9d6faf5e79f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 36.8MB
        • SHA256 0f48a71e28d674e56ba5c6869b4e2cb60929501d59298e200cbea032e6ee82cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.2MB
        • SHA256 47763c2a7ee8486252b014f359a0a0e210d95ecf28f9245f03a88cf49283a66d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 35.8MB
        • SHA256 90d8e28eae966743808fbe05d088f8dd559045a332e160ccae202ba462881f05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 29.6MB
        • SHA256 b723c840efc35d0e660acbd3e131da9422e4c3380f1d2f7fcc4bc1c96dddfc4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 35.3MB
        • SHA256 6db178671be51446551c98db95295c30fa2b6a8b880f75df770954a39a4be98e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 33.8MB
        • SHA256 a91a58765baa1407cb90ef29533aee6c90be7af03ccb92b10212baea5e6c665a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 35.2MB
        • SHA256 4fd79837f990aa0c18f4c67a2628028e39fc70572303258b33dc5bf86d305e9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 35.4MB
        • SHA256 78c978989271bd1867e5492c9f58512918e9bb32521b17872b84c48efbf5f1f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 34.7MB
        • SHA256 bdf4f169c868c12e948c2cdd1e1a5f60176ef2013b436f1314690631abd66e45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 31.5MB
        • SHA256 a445a4d7294ad032543303713cfdd4a19759aee58665564a9a8d969f80ef051a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 32.0MB
        • SHA256 3506b7e7fa750b19870da9eaeae7a717d58246cbad2075ec7b6365d1d2b7f9f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 32.2MB
        • SHA256 5b9537bb38ec7e7d34a724118858332dd36c1eea319b79c687268cc5f1465dc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 31.0MB
        • SHA256 a4bf62712ac7f11d814372630e8245843376551002690565a1c7e8229c6ca92f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 31.9MB
        • SHA256 c075d195941e232f3ed034885d43f30313b390b78d3131fca270313518e3ccf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 31.4MB
        • SHA256 6c272d45dfe323d7be6a9ce39f693ba45597c457a9d11002d34a16cf04bdc825
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 29.2MB
        • SHA256 12f6dc43a2ab34c89fe5c585827dd29db794918f5c5178d5b3c8179148c4a451
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 31.2MB
        • SHA256 dd85c9c978c69e212ccb057a82f038f5eec402468e02b005b39d98b5235eba96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 30.1MB
        • SHA256 8f13670aaa368cf207e7f203472a0e246a09e699d49586499078e542b8ab71d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 31.1MB
        • SHA256 62e7af061b44f27eb7daa0e9e74c8dd708090525b3d602812f47c45717bd9f3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 23.5MB
        • SHA256 cb509105afc05f6d795a225269b753d1810a6f7fb62f3587105a094bd4ad1962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 23.4MB
        • SHA256 e5d59c4f6dddebe55097fa315a252d42c72e0fe61e698f99649e709507ae4f50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1416-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1416-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2320-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download