Overview

overview

8

Static

static

3

2026-08-04...wk.exe

windows10-2004-x64

8

2026-08-04...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    59s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 22:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_89ab890191dc27dd1aff975a9580a67c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 19.9MB
  • Sample260804-2lta3sfk7w
  • SHA256 317e815e2c79afa0727ec3ad5b65ff4a6b4e07f48c63a6c3ef581e353dcd990a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_89ab890191dc27dd1aff975a9580a67c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_89ab890191dc27dd1aff975a9580a67c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3332
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_89ab890191dc27dd1aff975a9580a67c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_89ab890191dc27dd1aff975a9580a67c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4624

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 39.8MB
        • SHA256 2b34c45cb254d674f8c95d59ce4cdec6df958ed1180fd496128544a78213a2ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 40.1MB
        • SHA256 cc25c4d3012d09393c168824d43e00e07351d6a49640c6ec4ebfc3cbc7e97553
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 39.8MB
        • SHA256 dcddfc33a1d27e8646783fa6cf4e154aa589a87800376e0186cb6f5dc22952fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 20.3MB
        • SHA256 216ea4346339c82de0db692c38b63343da1564c5406e1c6e5b189c72b496566a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 41.9MB
        • SHA256 de481d1a2b02eba1d98ce27ea67f7bb9dcd378427d4bdcf22e1888c15a5470bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 39.9MB
        • SHA256 68630e09faf771662c8ebd6208a34757830f526d46da53cb6c6c49f381cf52a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 45.8MB
        • SHA256 1b64f8804a09351a092f1f05b0a34d15e192e73c702e329ffe611737e0c5b098
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 45.4MB
        • SHA256 37f9b286bcbef30b956e311b2c3126ca80fffbb097d35743bd639f8e5b4c61b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 41.5MB
        • SHA256 55be6eff9c65e18aab181279dfd7bdf906df1965ba6f384cd76af7816ee32222
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 43.3MB
        • SHA256 c34e83360821c837cad41f4ea3619395ad4faad18ae963bdd51ba4d5da544f2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 42.1MB
        • SHA256 f4e3f5b1a3bd1cd384b894274fa49990b626305df9aa813740c33a2bcdc9e559
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 21.5MB
        • SHA256 123e280894232cc76ce9963b0eeca76bb3b48a50559a2cde467b93fd406ae82e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 39.6MB
        • SHA256 74a836b0342e6e8fd55b7da348d28a392c43471d057793ed9d9b9efde2ea23f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 38.5MB
        • SHA256 fe57e1d4534c193e1d7acd5ca174f4849f35a13de3af8825a90064aff70bf40e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 38.4MB
        • SHA256 ca34b7e38c52a0940d1374fa85b0520cad70ffde6196d2711b55095043e7fdf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InvokeSave.asp
        • Path C:\Program Files\InvokeSave.asp
        • Size 37.7MB
        • SHA256 f2c993c387b24f0302b487f796465d61e7d639b17c1a776570c18b1ab77a0808
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 19.9MB
        • SHA256 b8b4cda6fc87676500ae98eef5ec2d670cb2cd15cc0694c4e3ebd3b71eff817c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 36.6MB
        • SHA256 2842b68f1e8fd093831e61d85068c2fb60bf4a8f535f91efb4ebfe20866bca39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 36.1MB
        • SHA256 2d283de6bbd4453e6e1a2c345837ceb4416eb0a793c3634d30bb1cca9d2d8405
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 35.9MB
        • SHA256 df3e73d7f139f3c82dd1d6027b5559d1215827efbae8149558c8d2bdb8313238
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 35.5MB
        • SHA256 40ec1cc414817d2f003037cb4fd8359e5362972f56a30d404f5828ff21e8f3fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 19.9MB
        • SHA256 911a8423f4bf2b9f8c50dbfec969577180e65015e9d1f190e55a914b08edf6e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 35.8MB
        • SHA256 1c0856f70b733dc9beaf190f72f379251ddeacfdd7009d02cf2e5d28d9c99278
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 34.9MB
        • SHA256 b82d71276a0648f70c30d6744e92041be6b3d94cb61ad20476ace2efa1565932
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 32.8MB
        • SHA256 ee02e1b45910f86303713319b1ab116830018ee09decd9865d5cff98c4e277d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 32.2MB
        • SHA256 85be377f0ccc9ba6f4357927ec857d5641f670650e3a90180a583ee6f2c142af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 31.8MB
        • SHA256 3218a1fc7700bee5f4b449ab752e843ec0074e413df705c32fdf0ea39fda5a24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 31.4MB
        • SHA256 5a928e0ed9a8c3806c4ff14ad1024d3fea2d2c8a992c9a51a89dbb22ce419642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.2MB
        • SHA256 09b872b979572404121b9a8c41266cfb588534005c1bc3e7d1a1a5d39d0b6504
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.1MB
        • SHA256 5782f88993a871f771ba3ab46edf920822aa601b39a874099f5db1ea72d7ee9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 31.0MB
        • SHA256 9d9986a709d45d6a2f917359191b09ed4eaa581e6baf732f768ee053b9c3251a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 30.4MB
        • SHA256 d7b0f92a516385d193e935d897602564d7b831d26aa08fd099b5b00c2185dd62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 29.8MB
        • SHA256 971fb7327825d5a78e41abcb953a5d1f680a1f24a84a92abec4d9e09e81df3cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 29.4MB
        • SHA256 fcfcdca758a8c47728d980c4efc89236ed8ac5977f96f1565737c4255e64e7dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 29.3MB
        • SHA256 c3814cd23b46d8888dbd3bd85a00015c90830f7d43dc7eb92f22ed3fcb113809
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.4MB
        • SHA256 e6f1d759258947289649b4a48a0cb3a8f1d8a9ae58ad8c0df465cc7f3445fee4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.2MB
        • SHA256 2e8a26c451a89094e4eaf67f58fa8da8e3b0d4c840c66545c8f2bdec91324965
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.1MB
        • SHA256 383ac19495c91e31e5dcbd850ddc58dbb2eab678487c6e845fbc24f74ab30feb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.1MB
        • SHA256 e6dad303d0882b70832495c25ce14902dc1c072917941d7db9594b774024f0da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 28.9MB
        • SHA256 eda3d788d16197d1c129f8741238fb2bb970bdb704e5b29ac917df7ee3e0534b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 28.9MB
        • SHA256 36f9122bd59b23d31213acc36fc569cd70131a204e2cf8b4a05dbbea8d1202c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 28.8MB
        • SHA256 ab2ed864e298d6794079efc1a8f89712cce178bdf448abedb2b78517a4a44a2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 28.7MB
        • SHA256 a222f51e7bc9092ba8b2d59af763598342df88799bb737e9c17de3a750bbd6e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 28.6MB
        • SHA256 bd386cd3b5ee970fe19fa5a9663fce9a6ec404917e6a943ac67554e17a383e13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 28.5MB
        • SHA256 2ae92aa14f81134863412ba9ceee43ae615a3f37efb8541593fe1e13a246a99c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 28.4MB
        • SHA256 4b6079b91d4ea74d304b3bbfcae2cc0359b08459f9ecff947bf11a290a75f228
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 28.3MB
        • SHA256 347618cd0b0647204e3e65f27d530190791bdd2c6be7a7f82bbd7a4e32e2bbcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 28.2MB
        • SHA256 6312f0bcd3dc8e19b0be22444a3e2e73f34cf811adfdc408a842efd1c4cd6f12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 28.1MB
        • SHA256 988835f08ee11cdd6db8541338dbe85d5f27f0493fc77a275e368ccbb3789cc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 28.1MB
        • SHA256 e0922f22810c4179790d07a152bef3da97b258b6e96b27cf13c60d62b5f82fc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 28.1MB
        • SHA256 61a7af9c6398dfccacbd1115a0f93e1ec91b1c77e4ab1ac95802bd1e1b59c19a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 28.0MB
        • SHA256 809e3608a329accceacd74de0399ff29d87fe7fa5a253b2cae2f1a1c757d7248
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 27.9MB
        • SHA256 0bd11b48c0c0010ed1a1b9a605549dfe006bcd6ea9888e6e0229ac95aa586dc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 20.0MB
        • SHA256 b6bf66599c80d80923ffb0fb0ca41f250032bb204958f7a7c73b0f733f8c53b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 39.9MB
        • SHA256 0882f24a8e3e99c4de1bf5fb752cbbab6af4330780e21eabb457f404327f62ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 39.9MB
        • SHA256 b2b025b3831040cee9c93ca316c6dd6b4a2a7a52e9ccc8738a1caa8658ed34dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 39.9MB
        • SHA256 b1ee215f9e6f22d3b87380c95f949d88603a40ea491258f5c73618b696125665
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3332-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3332-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4624-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download