Overview

overview

8

Static

static

3

2026-08-01...wk.exe

windows10-2004-x64

8

2026-08-01...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    50s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 01:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_18befd7f19c0b64f6f4a3f4715200e15_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 39.7MB
  • Sample260802-bme7qs1fqa
  • SHA256 bc71bce7d8011f32bc37e8d910eba3331940eb311342be37821c871d182d9947
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_18befd7f19c0b64f6f4a3f4715200e15_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_18befd7f19c0b64f6f4a3f4715200e15_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6128
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_18befd7f19c0b64f6f4a3f4715200e15_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_18befd7f19c0b64f6f4a3f4715200e15_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1852

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 39.7MB
        • SHA256 bc71bce7d8011f32bc37e8d910eba3331940eb311342be37821c871d182d9947
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 79.4MB
        • SHA256 7bf95e59ac766fc6186b21cf4e836ccf3dfaa4c8fe3833adf659750ff74905b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 83.4MB
        • SHA256 66d3619b921042b8898a993685b980b744a106226bc0efb7958efea5ae1149c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 79.7MB
        • SHA256 0caed466b23265f22c790bcca916f11f978e4f58f3a7e2504300ec12e5e2b93b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 41.8MB
        • SHA256 3b7d69345b8d477a1ba98f688edf63ecece09c3fd47aa18ed898013b699fc588
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 79.4MB
        • SHA256 316ae18055e34c0fa3d02397996a677882d99f1bbeca6be1cc5fccde7bb3ec44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 72.4MB
        • SHA256 f2527125d4c18364595170eaab9a7743aefde986739e31c05cf4f2c3285edd60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 72.6MB
        • SHA256 149c75e176329a063813c0b8e33ff17e23e15ae02c28a95bb839c2a2b84f54ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 76.6MB
        • SHA256 e02c9ae04a6e3c0fca57fa489ea9bc0e8790bb6d4cd288c9bbd6dfa40376c38d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 74.7MB
        • SHA256 506de824f538c2fd2e90592b8e513b7e97690b33229baaca465e48bb239b8342
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 74.1MB
        • SHA256 b42a385f115d8fa226433d10094c320995d565b22b5373e2affb38d622adb232
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 71.9MB
        • SHA256 5ef5bb609e6e1d4ff555f00dd2d16905bdc542857c597df7b35f2ca4a81d23cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 67.8MB
        • SHA256 2561e4a143b5cc1d61bc396b921f8612f91a1eb49275470f5e007f5adc3d1599
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 63.9MB
        • SHA256 a86941a660712b75706f38323c55d425ddde69e54e617c5363ac05eb99f6752c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 62.0MB
        • SHA256 74f106b4bab668ae5b05ed2925e64d065457911d73f3d0011880c31a2952fbc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 57.1MB
        • SHA256 953b77a8911d3cb6fb2ec7a9e24433dab7ab66289e738da3b58afe14a2ad9ec0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 59.7MB
        • SHA256 5aafaaca9fa146e07da8afbd1872c3c7892103a377b5a88697dc6f3ee74d2aef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 57.8MB
        • SHA256 13e66c278c07227d3a8900ac6d1f96920c750afe4345e4053952de419c4df9c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 59.2MB
        • SHA256 e03c441d3c5b789bd52adb55934a3fd23cd6da605cdde0724553bc9a5d70430d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 57.8MB
        • SHA256 7c4eaa3faa782b78d9f46d14d97da18edea8b34600f0fe3415149ca7b20d36d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 57.3MB
        • SHA256 b11bc93a75454516beda8700ca1c7e8389565bd84491bdd09b53608b5ee3ed47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 56.1MB
        • SHA256 70e3230f28dd011c289877d11fa0bf95d218b76a2bbe34aa562ffb35b90c432b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 55.2MB
        • SHA256 4977e52b9702b9f9e96becb922836e0650a0bd253904c7f0b2aaee12e03db25d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 53.3MB
        • SHA256 f1890727686a7c4be7b52484ae2f29a94f4f5dd12ef240a30917856da71b178d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 51.7MB
        • SHA256 bd389add090893aa5a372f06a1193eb8c0152312c1fb10f36d37daec8014df0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 50.4MB
        • SHA256 4bbc06535670c3679314ed220221caca372f37d0fa9f33db8fcba51449fa9c05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 49.6MB
        • SHA256 4eee4e856ed41c5ff053973ecaf1e1c8b1f9e4696ddc316f74b55a110b76b0ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 48.9MB
        • SHA256 cd638ec842c71ca730dd1f82bacbf8af62dee25f3cead8256d7de5fe21f0e268
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 1.9MB
        • SHA256 4e5547bbb3ea69abed617552a33cabf40e22bab1ca18c305335ae10f6979845b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 1.5MB
        • SHA256 76217fb3a4625515fe1c2485bf6e439bbce4c198139513c541b9fd66a39c558d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 64KB
        • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 79.5MB
        • SHA256 0cff04abca4f5f208c44380b80d0c1e0e15b18b84c7ac11efc3f9ef86dd9f5c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 79.4MB
        • SHA256 ba9ade113efbcf467681ab5fe15ae5f91f813c5e7c59b073aaf00a33611f3e06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 79.4MB
        • SHA256 d7291d6520d36fc64a14218b2215223344e2acdd357a6287aff22e948a4a0673
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 79.0MB
        • SHA256 84ef9731f1172445ac31c24ee68daa252a37af248c4ce21a6a12540cd593d2e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download