Overview

overview

8

Static

static

3

2026-08-01...wk.exe

windows10-2004-x64

8

2026-08-01...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    144s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 00:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_46e6703742b93e30571424955318d3ef_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 38.8MB
  • Sample260802-a7hypaz1ey
  • SHA256 16266141862709b73307164048ca2c6a3d2647321bce68c45fe1c626cce48cc6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_46e6703742b93e30571424955318d3ef_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_46e6703742b93e30571424955318d3ef_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1284
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_46e6703742b93e30571424955318d3ef_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_46e6703742b93e30571424955318d3ef_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2760

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 39.5MB
        • SHA256 781705910a276e508b54509b8df814e3a44927f4dbb746dd838ec4532dcdba99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 44.8MB
        • SHA256 a8976e5122e2ab23ff860560581ab93076b17ae42a942251d0d7ddfe5f4280e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 79.2MB
        • SHA256 59813fd1d778213098b20c08c2a208fe9418e83c8086506333502c5bfc61d894
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 79.4MB
        • SHA256 9fbfe472440afd7cd2e1d395b4d408677636d81e9a70323010607ce2b0816c36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 80.6MB
        • SHA256 7891c0145b564272ed18d53d69a4765b8783bc20f7c536ff43c87cc1f89eb174
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 79.0MB
        • SHA256 32912c19f5305f72ba70a30f3cf68ba6c07fbf6bbf023e467a38f682cd3ef33e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 77.6MB
        • SHA256 54e7efbd31313c40d3b023da5efb3e6dca4d9c31711d7642d818994fbd9db705
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 77.6MB
        • SHA256 637d796128a11966f2fd67d821983dbad8cf723514c6f7fe9245271c6fe9dfe3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 77.6MB
        • SHA256 d35294fcd906ab2f8d7db6dd6a2aa109dd5d8c0d2f6af563b3d6c0c5cf18bd2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 77.6MB
        • SHA256 ccd450094bee93e7eaa6019318bcd8f2616dcef4ead95674bc7cd9d63102aaa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 77.6MB
        • SHA256 414f04d867e9755cdec84e22e827c9ebcebe5c43904f137ff04b584146d158de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 77.8MB
        • SHA256 df3521cd42277efbb9d3df924627b0bf3829db78d8f354906e8dcc65fba40647
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 77.6MB
        • SHA256 a231e768af3f64df70bbabb8c66f9a5f34f652891af0519f7cec64d0e077ad0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 68.1MB
        • SHA256 0e1f7541ee943dff3b58945e92d379946c592e87c1356e20e2551452bf3a35a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 74.4MB
        • SHA256 57827bb9b46778a628e04c858765392ae008830363c5b6663153e3f53c336a22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 69.4MB
        • SHA256 e0bbb044d65696811d8d3a6cff84628f258c9d0c5434c0769a4ebbaf2ed9da2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 54.1MB
        • SHA256 55bbb81d04e3b41278b487d9536ecac2521bb7ba907e580ddb4e9cfb76c2f343
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 58.3MB
        • SHA256 724416ddcc49e442e8128fd4d6def09dbc9e60aeaf86ee115ff80917d9ab15ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 57.6MB
        • SHA256 47d7a876964f1dab3860b5ba58c027f61b3733586977690d1e3b5ee1a6cd508b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 57.2MB
        • SHA256 dd16e4ae2a1ef6d4d856d235fb78068d0d147e8d4ed643c3562ddfd3d4320879
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 59.7MB
        • SHA256 74faef97ddfc51a345ebb02ff45c3ba64127503309cfaef26f40765dd321ae35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 7.1MB
        • SHA256 1111aa8f21b4718a4ff35f0d45d18fa7c866a26c47fefbe3527d8a75db18b455
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 5.6MB
        • SHA256 a5546c0ecfaf1fab40b5492f276b0c57ca1505f990d56a38ce7b2094c41e5337
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 5.3MB
        • SHA256 c476276010e675d0e09d128056f23f1a0187248d6d24b55fb2ced06037dca294
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 5.0MB
        • SHA256 65f1d80aa27663cdfcc10f581ffe24c34ca1efa6dd6b23ad96e7692fe5090e77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 4.7MB
        • SHA256 52c95d59b4937c293d8761dbd9e637c21c4e784d88151c2f9eff97a8976e6387
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 4.6MB
        • SHA256 4edf62f24c651c4fd649263f53dcc6e7e15b051c3e49d6062b00ad804075cfd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 2.7MB
        • SHA256 1ebe82a87d3995597feba041d41361855683d9c799f2458cef96a2c25284d0fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 1.4MB
        • SHA256 65691f9726729c9692d2191d6450e4dc1ff77819780dc02063277c69ed25e172
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 256KB
        • SHA256 a88ab2eab13680012502e10692ec5c6fb70e333b6df630e671ad53aaa93b2f63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 38.8MB
        • SHA256 16266141862709b73307164048ca2c6a3d2647321bce68c45fe1c626cce48cc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1284-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1284-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2760-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2760-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download