Overview

overview

8

Static

static

3

2026-08-01...wk.exe

windows10-2004-x64

8

2026-08-01...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    143s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 00:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_aeae5f08652caa88e64e901a333958fc_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 35.5MB
  • Sample260802-abdn4azeka
  • SHA256 c55d08cccc4927f3229700442b93a933c7c98b558da1eff8e5e6c8f0403bf31d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_aeae5f08652caa88e64e901a333958fc_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_aeae5f08652caa88e64e901a333958fc_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2100
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_aeae5f08652caa88e64e901a333958fc_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_aeae5f08652caa88e64e901a333958fc_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4436

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 36.2MB
        • SHA256 0617bd47c304c5f2d88f54e88446d1c25e062ac564d980a9ac2c4dbd7ebefe38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 71.4MB
        • SHA256 6e769153bb090b98cd344106baa38ed3fd79618911b29e30ff6306cfcb71245c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 71.1MB
        • SHA256 21888235da19e854faf7ead6a306f4373cbbf2d3c438f4dfabe9e03197a726d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 75.2MB
        • SHA256 f63167e3ee60548c23bd15ac4f30e19b578e691997bb682e68f74eebfaa12ee8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 71.4MB
        • SHA256 bb663aaa67f6eb0697e9d9bce79dde1a715665ea1350d06b6e257e00771ad6bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 73.2MB
        • SHA256 aa6b7aa076016daeb7e18442d070982b2d50186466448af3be86ea2139376846
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 71.2MB
        • SHA256 2eb7f7a379a0322e751112b870e188884b192326d70b9f86f21a01dcd3a6d940
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 77.1MB
        • SHA256 8354174f3fbc634d67760f6977347e161d5813c154d0860f7859528cdf612c13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 72.8MB
        • SHA256 d0a9dbb37acaa9470a618391409f068c89bd161c6b7569528fa19daf8e1e2bf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 74.5MB
        • SHA256 8ce456c4486e1ba3c8bdc283543cbec2aa0ec1a13e5cf6c95bb83ba8e3f68efb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 73.4MB
        • SHA256 5df3533f1ca16467246ed6f491ce2a49132d99b1307e0d45b625c3ea03255281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 72.7MB
        • SHA256 89ce29ca6ca527376cb446dd03213f6cd8dfed28781f1886e24bdd401f784209
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 72.9MB
        • SHA256 17488bd10c327e8dbe985e9d24382460b4a339e23460e8cfc6c67c04c91b8ab2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 74.2MB
        • SHA256 48a8472ec00391f2f26052083309c15ced67eb8e1959bb821dd19b236f452238
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 71.1MB
        • SHA256 a6c9bc9f2eb793147731475d3fdbb98f2796ef8ec4bc936f696777a5389331f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 71.1MB
        • SHA256 129b16ae2aca2bee11a9a2b75b05e62436b619a0e4741dba88cdf770a9fb7afd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 71.1MB
        • SHA256 1d9b79d91ec055caff0e88e81f2c18eb3e2764356a1edcc3299a213ab8fc25ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 66.9MB
        • SHA256 6bb23a1eb531ec13e8593e3cb8fee4b378958f2567bd7d4c5dae52af86e4b34e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 33.4MB
        • SHA256 e98e49dee9965d554531e729cd745c7ebc486f8aabce43c4f0c4e6c877e5fbff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 32.4MB
        • SHA256 65cc1f4d8fbf3a815bbf02a19b4fce46255b6b107213533f5d65d2f03ec79ce6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 19.8MB
        • SHA256 275ebeb2416a749956f9a4d6ec43da5309f9faff8bc78cd2390f3e89ef5aeed4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 19.2MB
        • SHA256 ffc2b6e01d23bd0bd29e0725e58c007bbdb4369c14b5d5a09493a9a172add89a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 20.6MB
        • SHA256 dbb2576f1652ba13dc44cc1c90c7e090d0908a48812bc1a26defb2bb7b8d5937
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 11.3MB
        • SHA256 639534a209976b8ec737a25ac52a7f415d24d3caf3b732a27d3f5ddd5ee95628
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 12.9MB
        • SHA256 a814532cb7fc602e6653344013bcda9c36ba25e753b045811e59e115d7f2bbc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 10.3MB
        • SHA256 27d097ca0db873ebd80e8dde3284330df581fc55048d127c5c8c92cd0d29ee32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 71.2MB
        • SHA256 bdf4d91f7d09558cacf15da83863d5ae66a973510ba12faaaeb05c23e4ecef25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 71.1MB
        • SHA256 5fad340474f4ba55ff329bcc7d92a7ab29ed86c5eb29e477af69d060e02c5916
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 71.2MB
        • SHA256 5ef42278dffc6cbfb54041eaeae9d8c0c9c33057e187293fcb51c5bf87150062
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 71.1MB
        • SHA256 af8a66bc1e2a44f0a61031e8ec20dbbe46a0e4b1d8336ea80c396ebbcd0c2cbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 35.5MB
        • SHA256 c55d08cccc4927f3229700442b93a933c7c98b558da1eff8e5e6c8f0403bf31d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download