Overview

overview

8

Static

static

3

2026-08-01...wk.exe

windows10-2004-x64

8

2026-08-01...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    41s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/08/2026, 23:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_d90a7fea2d06b02355004e733c6194c4_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 33.4MB
  • Sample260801-3nbpgszbph
  • SHA256 5382fda4143a3a40ebcf1be342833ee0e3c2df9659ecf096cbe0d6488ffe211a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_d90a7fea2d06b02355004e733c6194c4_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_d90a7fea2d06b02355004e733c6194c4_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2956
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_d90a7fea2d06b02355004e733c6194c4_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_d90a7fea2d06b02355004e733c6194c4_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:952

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 33.4MB
        • SHA256 3801417518992c60dc3ec8a2c04665f7b8d842f0cfa12e1d434e5c846e56a12c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 37.5MB
        • SHA256 5b9bca2c1c1d1035448d47aa8ccedf7cc0f4b4555a3360b9b853ff35b65d3284
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 67.1MB
        • SHA256 ab5b5edba6255f5aeb92aa49db088903b3f49d7d66dc17a8610c7b9146af6d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 35.5MB
        • SHA256 ad19aae525c645945a5c72c7c6ccb3d5b708e3c0344f0e045fc66d2074f9c7ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 66.8MB
        • SHA256 2df1569e89716dc830ce82292e90a5deaa337467d965ab136cf82af23047d69f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 72.8MB
        • SHA256 f9062faa0049eeddeb4dfa06091d7ff2dd6ca79d907c2f7daba89ef8f3e205ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 68.5MB
        • SHA256 de99b14c6cbf4a86614c34543c02c56080266e6bcbdacc96969f4f1e62ceaab4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 70.2MB
        • SHA256 6d6883380f32143ef0ec6fac5060ca20e580eb6d3ca53303bb95e68a3d3911ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 69.0MB
        • SHA256 1c0502cf599d5c5fc4a151539a8094dbfa5d27ae07e63383c958be870fb4a682
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 68.4MB
        • SHA256 cfe0cf4027e717419d8b70f897caaab5113ed9bbb802dfdf37a8dd4825513de2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 68.6MB
        • SHA256 e017314a483545d1bf56c4469f09d20c762db913f50db39991fa250ce2a82df0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 68.1MB
        • SHA256 640a0e480a52b31c56deba16cb916330e8b69e4c67b1e3e3981812e6745237b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 66.9MB
        • SHA256 1005fd189061894ef3814371a124317294d24521b941ac06579d09864faa7a31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 64.9MB
        • SHA256 d19f7f7da5429331e12bc8dc45ea3c49d2f32958a9c46de0447748b063a01cc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 63.1MB
        • SHA256 48463af55ecab3b9e6c48b754d9d68409811fc97893a4a4f50587ccde071cabd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 60.6MB
        • SHA256 faeff2a2519accc65be81f98e6447804afcdb740653af9ec52a1f4d00c661be5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 60.1MB
        • SHA256 443d30e7b54f5c7490e0c6fee09ce67bb0c85e43284db9433a5547bed3b4a55d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 59.1MB
        • SHA256 cddb4abbd655be3ee1fe27cd7da80ebd93742e00f484c3f6c4813e3e0c35db65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 58.3MB
        • SHA256 90e31da63295736c78f08ef3149947c86d3a27e7ec558173a1ebdf245e609d51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 56.5MB
        • SHA256 9c84a681fcdd8e9b1b726e9f044083835022c775a0a3128a6e3136500aa39f6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 55.8MB
        • SHA256 a6b47e360c84ebf470e94e9d3e7b71dbfad6c8d2f4d92fcfa8a3b4e914d49913
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 54.4MB
        • SHA256 42709c0700a1529de61e9c7600bd34643ca1506faea7662673cce9c73fa016da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 52.5MB
        • SHA256 b5d0e53691419c958bdeac411d94a55dca60b8fb3d9b5ae3126849ef0e563996
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 49.6MB
        • SHA256 ecee876561f3eade57ad30d8d621f4afa151ca3431bbd1c5eae7416c7acd51f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 48.9MB
        • SHA256 f8cbb9f44533050ec93aa0b3abc52c4e0066266f121ee3abcd130d177e59159c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 47.5MB
        • SHA256 12f5428948680154f761ee3209716dee6aca226cd692693b6b87e13865a95b1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 47.1MB
        • SHA256 0e555ea92084045c5595be8e430fc71adb24db8db3ff2fb15e74b95c929f1811
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 46.7MB
        • SHA256 f01ca22ecbde1312a77d76dc03a04fe157ee59110a160bf1c6fd313c9d1d2b4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 46.4MB
        • SHA256 ec232ab612261dca6d9b04d803cb7815488fe61956435757810282c98c74804d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 46.2MB
        • SHA256 f6c0cd3c9aca512c2e56300f9b48a80853908996311490af7bce3b39a259968f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 44.5MB
        • SHA256 2a75117a24676edba75be522a63169f1e1d8c803e69d0de2c960cbde71713349
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 66.9MB
        • SHA256 766404bb0f0bbfaae120e46e18ee53edf9665d0b167b730bb7b0ebc058de7e7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 66.8MB
        • SHA256 af932bdb259007de5d1bb2ccf81b3b73dba590bbaf105e23517de089c9af5f8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 66.8MB
        • SHA256 6161c4e99433466a4a26d5d083774642912b7994fb7b7787ee10642884b4cd1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 66.8MB
        • SHA256 780e751f03fe4044c7d7c7aabc1721a4fa8428684fd6f5a34ecf83af168b7cbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/952-19-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2956-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2956-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download