Overview

overview

8

Static

static

3

2026-08-02...wk.exe

windows10-2004-x64

8

2026-08-02...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    41s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 23:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_b5ab64a633e75f67bfbeb70f666c85c3_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 40.1MB
  • Sample260802-3t31xstfph
  • SHA256 4a5aadf16732212567eaaad9a1652d782c06c91985b1fa524dffb5442f8f29eb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_b5ab64a633e75f67bfbeb70f666c85c3_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_b5ab64a633e75f67bfbeb70f666c85c3_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5160
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_b5ab64a633e75f67bfbeb70f666c85c3_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-02_b5ab64a633e75f67bfbeb70f666c85c3_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3420

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 40.4MB
        • SHA256 1758d6be3bf71d9ca45a45d802fcb2740ac95a64a99b6d5eed46c974b6bda11b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 40.1MB
        • SHA256 adbe9ac59521a4aebf179868ca31660903e8c09d6b77eba37a94768cbf71fd7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 82.9MB
        • SHA256 66bc2ca0eca3251ce078a5d6846023b6db3c740a1636a47fefee0ff3dadca720
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 77.8MB
        • SHA256 33bdad5887fd421102a745a32564a81bd1251a327d2f31ec18ac55e8a4b3ce82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 42.2MB
        • SHA256 d833f57218877fe1e5df74e67d7449c676b95a88b450d05a0780be434c1861fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 73.4MB
        • SHA256 13bbb9828446acba9106fe868915361db56de99d7387eced7b253bf711eeee48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 56.2MB
        • SHA256 9db0a816b1fd416a64ae6e536ecf301fb07b4d5b78d51f22ed38e99688d438a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 55.8MB
        • SHA256 a3a4538e7b1fa82e6dd0143fd080a4820203874b09cfc6abee1109a18a264436
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 60.4MB
        • SHA256 b1629aa8082a107c05f7f3a897e175e17bf43b7856cf169bb498b3d398d80d1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 57.8MB
        • SHA256 d161a046e14b70d38124c1112f333ead522a189b322472ac2544f8bf7cc41dcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 57.1MB
        • SHA256 639bb350d85847fa9aea41d3aa9b737d8b8e633a89c7e6130a0716a832f37e98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 55.4MB
        • SHA256 0ca9b8c6c8db1ce887c84a785c2e5edce8fab6ee39fec585c3ab1f6127cb9081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 54.9MB
        • SHA256 7c06a94ca987c6da1f956a67f91bc06415cde965946c810f1d880b69f35388ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 1.2MB
        • SHA256 0d0258c89e76dc4257d5b19fb97ad8a3c681955e184d38b6cd889691eef84576
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 51.8MB
        • SHA256 4013cd4f4c0d0c6adde910e28b16f0355366e374e7055c4fe1ac259b3127cac8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 51.1MB
        • SHA256 4dd13f7842ceaee30636e49527174c1d6967d66065b6cfe3b802004830d29abb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 49.9MB
        • SHA256 b958047804bb8b0b5c0fdca396b0528bc5fd0e76e02a46d6f908dac38ee412fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 47.4MB
        • SHA256 5cab9149df14d6ef851a25204118b7fe196ebd65bad9f6dcfbd2df662b22151f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 44.5MB
        • SHA256 04947253a26cfb3cc94845a38d615752f68d9578bfc3f83df4e2cda03faf7aaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 42.5MB
        • SHA256 b362079a8635993dfad77e4e470a3cabf63e5a15d1bf93e0d3bb26f4bc3aa77b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 41.3MB
        • SHA256 9ce50884112023e0e1a9bdef203ad9124b400a2678d9e9784104091f4810625b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 42.0MB
        • SHA256 2a09c2eb4ca98dc793fba208d5e0e3b7b071ac923f8255fe21fe081e440f6abd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 41.8MB
        • SHA256 5c94a1e20e5eb1c89da61963389760bd64994b4b10ea752a2b76266db4d34a52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 41.6MB
        • SHA256 e8edfa8f272feaf003056afc97f2dbe45b5560cadd476bb396dc82f722dc5b3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 41.4MB
        • SHA256 37f7a95106a90106937b1269faf2916e6d7ad84846473250e81f0bb470f7ba24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 40.9MB
        • SHA256 7044636ce52640545c8c5c195cecb9076289fa229a6312dbea177a0e15249f09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 40.3MB
        • SHA256 475e8b18b0013bb677f669f7843ef8f392c4edcc81c3cb1626e31dc783fb4498
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 39.6MB
        • SHA256 412e06a9d1cec0f82de74220af4476d0e64c2c94b2ceb96fa64e095dc3751262
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 38.3MB
        • SHA256 e2c22f8ca94758a80b1c0500256bfb06891c22ebe673e7396e4d61888dba5023
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 37.2MB
        • SHA256 26e2b0a8855a56ad608f4791b1715b49e0f4017435f17c755ef0a9f8800e499d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 37.1MB
        • SHA256 4e3dfb4935d2b476cd08cb2d69e69a6eece31e14a2cc6ea47778bdf1fb52c623
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 36.7MB
        • SHA256 f0b38d221fa102687b316736862be71859efb5cdc56883ede8706f3e3a551e45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 36.1MB
        • SHA256 b5eb39bdb35041997f83b49f8698947aac5540486eb5f25c62f763b5afaec541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 35.4MB
        • SHA256 6f7010f300a439d3d776656442be7c9d48489a21b49848bd9368f926eb21cb64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 34.1MB
        • SHA256 1ab4fc82a497e19a39bf4c27b98c9fcd264fb2e199ab1c343ebaeae25ce26ee5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 33.1MB
        • SHA256 dc0ea0752c2e647a3d351e2cd1d19459ee4014f889ca6c290479ebf86b6f2cc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 32.3MB
        • SHA256 b1be63a1a6367e8ed30c07bbb63ae7b6fc2ec2dee37a294faede4af63dff8e43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.9MB
        • SHA256 e0e0e776864a05686d30e56eb4ffae0c0be3d4c90384eb1f88ba2120cdd87950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.4MB
        • SHA256 45ddb7a4984672c92f52a2c6168fd6106f2598854af6d02088b7d85eac847fa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.1MB
        • SHA256 f01fb6867fa189fe9bcf498383468e035c231c7a02ec9ae34b60aa7e46a52383
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 68.6MB
        • SHA256 5ad5872255dad5bebeec0fccde6df3e8fc4e3a1ad0521ea45f4b9c1e2297737b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 66.8MB
        • SHA256 bb09533fe1b3bc143c6e4014425a4f928b6df38c7c99f83c15cb638f1922e315
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 64.8MB
        • SHA256 b073a2ac835ded31b5b2671a9e466c911ca16b794e79fc8611b3ae7849ff2cfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 63.4MB
        • SHA256 08a5c3aef48ae1152508ba018a2ecf35d6a734ac1cbaf51b64e5d561ecea89b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download