Overview

overview

8

Static

static

3

2026-08-02...wk.exe

windows10-2004-x64

8

2026-08-02...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 02:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_7ec91e27fcd0acdb49b44bad322ca125_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 35.0MB
  • Sample260802-df242ashjd
  • SHA256 25bee4cb872c093175c3f8525b7443c0844b10f81e72926b016713a2fef4f004
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_7ec91e27fcd0acdb49b44bad322ca125_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_7ec91e27fcd0acdb49b44bad322ca125_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1156
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_7ec91e27fcd0acdb49b44bad322ca125_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-02_7ec91e27fcd0acdb49b44bad322ca125_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1360

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 35.7MB
        • SHA256 a74192374d461167524b06172196f1a91322289b04a7f2c34b5ca49bd0825121
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 41.1MB
        • SHA256 4a2de778ebd02514ce01c94b705847d8a9e24ad14396ff23f6aff6d744e2a208
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 71.6MB
        • SHA256 0b3d98e089434ffb80d02122e429b917af2a896ebe3b50de6e0c7f9ed3ecf99d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 73.1MB
        • SHA256 1d409b72336da4e04d442187de2afd578924bf665b543c386d779fb55085f4be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 71.4MB
        • SHA256 06ab176b5c145a8b5ca29a7882ba0dcfeec8a2b1999d146560f76c6523105b7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 70.0MB
        • SHA256 66d1e22950241a84ff55edabeb621932780014cfc565e577b32eb06f3a2d8859
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 70.1MB
        • SHA256 d8fa9b71ee2621da27b338a7bedc99ea1f7477c35d3bf12710307cb071f99def
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 70.0MB
        • SHA256 aa76c746c2498d02ca4c0f528146d28831e718693b4d5e6a66cb18eef1c83038
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 70.0MB
        • SHA256 5ba7bbc819b4733dd8aaae6d0789ad1a67739effe4b4eca84eca24b4a9e4b5e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 70.0MB
        • SHA256 7631796624a87d145a32a66e7e5dbdb5e69dad7207ab8abc78826eb7944fdeb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 35.0MB
        • SHA256 f6123e330f7e2b487520c4d27466237689e2613e40c00530ab55acc36e725e03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 70.2MB
        • SHA256 21d56a486f7f39a8d08aad6ddd276ce2a2288606556ace3acfdb324b1121aba6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 70.5MB
        • SHA256 ff675c3a6e2b2cd0032f80813f1be9bee3f3999c35937d572a3c7bd651bebd91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 70.0MB
        • SHA256 b4db4cf110b72f72cf19e9c63ecf3a13da558c7f56679812e686233265041f88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 70.0MB
        • SHA256 9979caefa59d542792f50192bac1cf9bc1a5caba36ef1ec1109fe0c95eedf8d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 70.0MB
        • SHA256 39fa7396044cb9f55cec7ddaca5515a0952bb789f8aa878756d8fd25c1989e16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 70.0MB
        • SHA256 d3dd48162cafda89935de011febd82e822c2bd69a399628ade03d18d7c0e271e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 70.0MB
        • SHA256 aee93afcd1d9c9a180be51916eb0b49707c547980f5a3ca9bf707996b90b921b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 70.0MB
        • SHA256 67b0fc5e9357a328cf40f71ec3daa239d382aba4ca5023d421111f6c51cd361d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 70.0MB
        • SHA256 098d8e19858c226ae3f49e8e7f9dbbbdd2b0b32ccd9234ac8cacd03b0fde415d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 70.0MB
        • SHA256 7a9a3d2070414c36ab85622ac1b7b694c1cf9ef1d91e442fdaea992cae2ffd56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 70.0MB
        • SHA256 e2fee9fbb8c55b5c8cbcfd4506f286f87f4be645198e20d288490805d1d099ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 70.0MB
        • SHA256 225a350ebf751f74b6651dc2ac487f91a19aa0b32a1c6e36b9f87bd6a198a40b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 35.0MB
        • SHA256 10fb157329b31b2f84d9e51e24d60d42ecae29dbcdfe8efb989a66304b1c0ba2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 58.8MB
        • SHA256 82f0e91fefbd293049aff2f5f2684e9c069606fe483b0ccfc9cf8eff7c134b2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 58.0MB
        • SHA256 36f6c1fa17809f6c756cb58c7a20942088a905396335a69b4349bad0c57b1f32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.1MB
        • SHA256 fcaca58372098f02093d7075160443ad43aa9f1e4065d7485f4b5d7843652b84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 51.7MB
        • SHA256 4fcafc8c3330f1f17b5d6f1962ccab0112ef97079d94b004e505f6f4ef4890a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 51.1MB
        • SHA256 2a578b24a76c1d5c4bdffa803d393a97e1243ea8d5a220cfe2c40d6a3a5ae938
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 30.1MB
        • SHA256 4e9adb46d338753ed24903d08835163c06a31acc9097567a750bf1facbcd9935
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 12.4MB
        • SHA256 2e076584ef4bd5b9eb07deb44d9c796060f5e111b3d962eb202cb64edc5daca0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 5.6MB
        • SHA256 8bd1979d9b79580a8dc5ad4376acdaed30b518309b13050b5ea2f7aa63d93536
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 1.6MB
        • SHA256 dc63f6b748d6a3c753fabe4f9982dea2e899d403eb2e64dfaf22c8db39a51f1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 35.0MB
        • SHA256 25bee4cb872c093175c3f8525b7443c0844b10f81e72926b016713a2fef4f004
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download