Overview

overview

8

Static

static

3

2026-08-03...wk.exe

windows10-2004-x64

8

2026-08-03...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    29s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 04:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_a27a42999f3f47709199a2c695a68d8b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 23.4MB
  • Sample260803-ffvq3asscs
  • SHA256 5e4b530aa67303f3e11b476fef165d42f070c552d23ff85b86dab3f0e9f05acb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_a27a42999f3f47709199a2c695a68d8b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_a27a42999f3f47709199a2c695a68d8b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3564
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_a27a42999f3f47709199a2c695a68d8b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_a27a42999f3f47709199a2c695a68d8b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5412

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 23.7MB
        • SHA256 e79e71c6fa5b43d11c943f863acbd4c849311009f2e9fe4323c0d32bbc758dfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 46.9MB
        • SHA256 24a81ab2635e3b18439fc223dfda6b1bc3169c619f4832fbbdc953ce91c7ecf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 50.9MB
        • SHA256 dd0aae1d3468bd9c801fd66bb470b35cc76300efda4f7bb4fe20183557586bbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 47.2MB
        • SHA256 cd8e191f2a56acef0bb43cd1328781455574c055a068836c07fe082a3ea66396
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 55.9MB
        • SHA256 0439d557d4036aec99da6b317d9cbfceab6ebcf27d4fc0967d20d5a4c1519cd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 25.5MB
        • SHA256 70f297d59e590c0a3ce4707a212de6c2ff7783110b23d343a01a832d89f6e6a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 46.9MB
        • SHA256 4ff06b5a86ce0567b88be3c6d53f10d39a6ecbbc664512c9f07f806c14862646
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 47.6MB
        • SHA256 10e3c1c0e1e82fd08b7308f86ec1ad2f6afab5f037fce3ce47cbfb9bb7af77a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 49.2MB
        • SHA256 8000760b281f598ba719ab82dd051d649174930f8ca1304697a038f1dd9b7102
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 48.4MB
        • SHA256 4976dec832c6cc3e4153d5f914183393fa5d7ff8cf3b613a2e276d21f5c6d1fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 45.9MB
        • SHA256 9c8fa44ee36017883d77fc6543af927a207ed0c9e741be5247a99de9bb8f67a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 43.4MB
        • SHA256 ea9213e5912e69a4b82430402fc3e5bff9a18c419d7d126c3279b10de8308982
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 38.7MB
        • SHA256 49ba4c0321b0605bb4e6599a40942725ebd05fbabbdcbba62f36456a24148989
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 41.9MB
        • SHA256 b15b7f16a39b000e8cbea2269f86aa8a06c9cd6ee1a3a23c7a893b85815f9dea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 41.4MB
        • SHA256 49f4d0fb1c97d3767fd5c54639a04c073a15cf4699a85b13abdef91a0dd8ff0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 41.0MB
        • SHA256 3b182087f6016d64cdd6da3abca3e6cd1ad19bdbac937c291a5e61db39ac7e45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 40.8MB
        • SHA256 84f1140e6da78d7eb017bd31a9197c2b5655ccbb640007387435089ff74e2553
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 36.9MB
        • SHA256 33f7094fe2edf50768683a3ccc1c47349aef86d3c7806f80aadce80487236bcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 36.4MB
        • SHA256 2d0b5b93c550e43cc563d80935206ec9c87dc9ed0741154813211fa8dd7b5de7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 40.5MB
        • SHA256 46719bde2b45ba66aca6b6615ce01fecd60f5a8b2a3c2f876077a0daa32d249f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 40.4MB
        • SHA256 e7232baab0a47ff24d9a95083263ae40d8d469ee55beaf90e1f6555ce26c9e45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 40.2MB
        • SHA256 99b895eeb32f82336a2a6e187b1f5ef4168361941881164936087526b0df24c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 40.0MB
        • SHA256 e101b513e1a41b057cf9ff19a4e2071dab021f0d5b8ec81b0085710e7bf2205b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 36.2MB
        • SHA256 8fe10f9e2e181a446ffe318bfcce9ed6a4199345e9af3a5fdfe016d7d02dd5d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 39.9MB
        • SHA256 6ae0a903e1104ec0284f5bb6e8893a63469e30441d42a556c26a22a8b6aa43cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 39.7MB
        • SHA256 b1fb9d18a5e86d9b6619f8eac07ce415c969f76001ab9b52b9a67951f9e2fdc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 39.6MB
        • SHA256 6a76f3afb17d3ec3d6222f022901daf6fa7725f08bb9a60692d8a2ba68c8f63b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 39.5MB
        • SHA256 c6150dda2c6977758ebd11a32b451e671a60cee0e94af851f0254eb655bc56b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 39.4MB
        • SHA256 eb9dc14d0caf7aa5bc7a637a17497a5430d2da5bbb438d1e247fb753600e1792
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 39.2MB
        • SHA256 b6052af988ff3ae30154fc2332ba6ce00f482efc5208d79fac5707be97b17e85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 35.5MB
        • SHA256 e9a603ac728b63b92123ceab2b9354a4410a363c160c6f7cb319999164e4d6cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 35.4MB
        • SHA256 b1aa67261d0e326c1f1ae4a2074e77c6fe48fcf3d4103f5ffcd33d30ab821d33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 39.2MB
        • SHA256 d32e810b6d43db1d9a8069a9a1f9df56f902f60717ba086431849ab5dbb154e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 39.1MB
        • SHA256 cdf5e8b44de604bbb3cdd66fb0b4ecbe583112ddbbdc25f9a88721de81cbf860
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 38.9MB
        • SHA256 d18e62a1b96ac03d91ae6755bcbbec240414b29fca3c87145254a86ba7ed3863
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 38.6MB
        • SHA256 4221505e13c2eb127edf38682827860f70b26a52a423804da8e784dfd399e2ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 38.5MB
        • SHA256 e894cc691a79415ab0dbcd9ff39bbb83f87363159cedd01bc0e5406c9cf136d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 38.4MB
        • SHA256 988811a211166d56e4933bd61c6923a91b9a8ba47d47eb301a92d9e9aecf2a52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 38.3MB
        • SHA256 d87df347c88165df70c3ea9642bdc06ae35b40d0835cd9043fecd4ba9c461044
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 34.5MB
        • SHA256 86c85c26be39fefff05f2fd192b64f9db61e86d823485880cdaf3d523f22d9fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 38.2MB
        • SHA256 b3b416fd1589b1469a947f6ca257e488bdec05471c4088f5337c59ddc151b05b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 47.0MB
        • SHA256 23cbaee73bf38b87e0fde05d2aaba5fb0fbb5bbbc46a545c26eb0c13d5d7b082
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 46.9MB
        • SHA256 d3ac8524cc6660f30910e376c71f9446510844e6f394bc330bdc94896ae327dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 46.9MB
        • SHA256 363ed49c444df44efd2972412d479d142afe5331d8eb28830f2e8468c5fc021e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 46.9MB
        • SHA256 fbd368d07123a71a688834662687a03f7471f29995d84c0b69b8fb51148d23a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download