Overview

overview

8

Static

static

3

2026-08-01...wk.exe

windows10-2004-x64

8

2026-08-01...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    35s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 00:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_8d7994ce8f9b72351174d56e1335eb49_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 35.6MB
  • Sample260802-akhdmszyat
  • SHA256 f2b242689516ee4aa679d1cb814bf9c2776c23193346614ef18c9561e6d7e9aa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8d7994ce8f9b72351174d56e1335eb49_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_8d7994ce8f9b72351174d56e1335eb49_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3316
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_8d7994ce8f9b72351174d56e1335eb49_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_8d7994ce8f9b72351174d56e1335eb49_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4940

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 35.9MB
        • SHA256 1d29fbc9d03c206d8f88e3711a3769e0d6f6c1bd7c3302acabcf1b2c3c25e228
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 71.3MB
        • SHA256 0ce7e3007b004d13f969048115b97485e20be49589b7338fbb7738470afb1e49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 75.4MB
        • SHA256 32e328689d66134cff57464dd65767b9765a418fc61e300314b3d78158c24900
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 71.6MB
        • SHA256 2b32e8fcf0a10efc294c4810e1c60893db050082d758fbde617e29381ddd8157
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 37.8MB
        • SHA256 78eeedfeece3d4bc4b9314f72b6c76e11c38102bcb56c552fd784d73850fd1be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 71.4MB
        • SHA256 3f916ea2e55b9c16d25853d5b35117ff828c97ba99922bd3cb9cd091ba0274d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ConnectWrite.exe
        • Path C:\Program Files\ConnectWrite.exe
        • Size 71.6MB
        • SHA256 409a877e9031419a7779d5abf1409594abe468bda66d3065d6201c6d748a39a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 70.8MB
        • SHA256 8f921e22c172fa690e3b3f3a68b68bedb2ba06d626780829bb17f3d4fcc52534
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 69.1MB
        • SHA256 d8102068a63baa7217bce500f48e16ba556bf167e6d84b7e21d9591209b8ab89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 63.1MB
        • SHA256 db177a7e53d42034721ee2e3ae8577be84e3f19a80cd336a96d41d66a6a53154
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 62.7MB
        • SHA256 91dd7a0d4751b54d5692f6e2338db5c4b810a1289fca0c7d5bb6c517677da306
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 60.1MB
        • SHA256 14aa9331e9cf76ea2ed27b673f7779435f4bd82266ec14134322e17451763037
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 58.4MB
        • SHA256 05416f2b8dcb79c04e41c1fbb2e729cd6bca2c286cffa0c7411c892744f3ec79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 56.9MB
        • SHA256 0057b67e771cb5b1c1a151224067011f8675a56a532897ef56fb4a307ca43dac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 54.6MB
        • SHA256 dfde75e125e313e474a245196065bbf22475368b75cb407d9f74a4d4cbb908a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 53.3MB
        • SHA256 16de328735b2d9061ccd8a9891ed0ccd7320753699d9de25f93956a6caad8d07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 53.0MB
        • SHA256 72ff2c3081762e344cf615dc26a33cfa7450e888cfc37a43631abe1a65d0eaa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 52.5MB
        • SHA256 c921fdc556f614a996923f0c8891c605849b6b9320e53455c3ccc1184ad25786
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 51.8MB
        • SHA256 283105f14d2f86f84f6a6b18bc377b103fae91b696329c4e2859c7c19331724d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 50.8MB
        • SHA256 1a04336ce517adb9f80087fe1e70d332e2e95c17a1825be030405b329f686011
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 49.2MB
        • SHA256 8678e95dae429ab50ca8290d8c4afcdb7a5fccd4ded81c7be32c13fc1ee4bb7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 48.9MB
        • SHA256 3bae783347ba0b7198abe914d51bbe145ed55967fccf9191242f5eb37e4b54ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 48.6MB
        • SHA256 0592a73e4f56e1b51c5589aa8916730a0d07d94eefbd6cadeeeca17223b9f5b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 47.6MB
        • SHA256 cd12e1daa0c4b9d5018de86c468438af6d88e8c385e9709bb2b71bd4dcd0f169
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 47.7MB
        • SHA256 31925c55ecd1d6909e9e32ad7a080dd7d6f584cc0af751a25515d7e97aad8000
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 46.9MB
        • SHA256 d79f8a331f1166f5c940bb87ed82e52ca72b71f051de85943e03c2649976628a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 46.6MB
        • SHA256 df2d64537722aaa3a5b3ad38480dba53cd10419de2f51e1d4e740c9c8581cdd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 45.9MB
        • SHA256 131d63031910e367b830d3d830102aa5e0bf5654f389791b39abcd545da2505e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 43.2MB
        • SHA256 2b832dc2e8cc7a1d4a0a379072af8482ddfe111335409d052fc8a5ff99a86d62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 40.9MB
        • SHA256 783ff8a6ee9248ac5058a1736da00fd504ac1d7a3d4c1f320bacea6c98d7e6ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 40.4MB
        • SHA256 e2737db3f9abdc86552a4410347351fd773a58e0a2436e0a05d06c2039ef8aa6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 38.6MB
        • SHA256 4491131d1d2e50ea96e55590f01ab894dc55357e20022439875aacd35fb526d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 38.9MB
        • SHA256 cf90771ec8a82a658dac630988013b0d7f1b8c0927b9ec425972ca4db2220e6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 38.6MB
        • SHA256 b4478c130c4db0bc371c3e68ed5770ef458ccc48c7d6000a40dcfa565767715f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 37.8MB
        • SHA256 98a187059bdc4ee30f3252b28be4bfe4cb80050fcc2d909c5e127ea92aee1c94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 37.6MB
        • SHA256 409e99276e4841be43a48dc279850a3573a8c9afceb80a587af3904c1eef39a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 832KB
        • SHA256 fa8b9cb29a86f59d8f273b148ff27cdaf09d33b15bbfa2790ba1fd0a9b50a372
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 576KB
        • SHA256 9b9dd530b295572b4946420b8542313a6c2a581d9a9ea1114d003faa51914d08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 320KB
        • SHA256 3b2679bef1dfc624cc66cba514201f6f20db7692b1c43cdb81a938876ffadd4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 128KB
        • SHA256 e52488a8a3c5c15a2f928eb2127c84d20ca0143b2598bd3c627a271a6a7a3d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 71.4MB
        • SHA256 377621b4622fb02e02bbb7cc1e5c57225d4159d98be7e19ffb5d0ebc3646ec9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 71.3MB
        • SHA256 f8e864f033ef8afd173bbcba95232bc1aca49edf656ede10e64dd899c8bf304b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 71.3MB
        • SHA256 9ff61e6fc924f6e5fac4bad85959b4e28d01c3bb26b693993e0b0e22af239075
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 70.7MB
        • SHA256 c9a9990358838902eb29b81341b3f5b652918ee65d9b5e68689a2da103b14e22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download