Overview

overview

8

Static

static

3

2026-08-04...wk.exe

windows10-2004-x64

8

2026-08-04...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    123s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 22:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_86f5261a7220d46491bb3784f321c791_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 29.5MB
  • Sample260804-2mg97szvbw
  • SHA256 9cf960c1ba904b067571cf50b5882cf9d1560bf0ed20db68ebb4acdc9814e53f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_86f5261a7220d46491bb3784f321c791_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_86f5261a7220d46491bb3784f321c791_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3948
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_86f5261a7220d46491bb3784f321c791_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_86f5261a7220d46491bb3784f321c791_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1700

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 30.2MB
        • SHA256 9549af1932ec2c860e512dca34073460af167859b9c86688910e35ab39156a0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 29.6MB
        • SHA256 062b29a4a9044e9e9600f54cd4cf5b46742bd8060e58ab4028e86021207cf165
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 33.6MB
        • SHA256 271928cb3d232ef429a363673fae3c83f7240b68b75fd67d447b3fbfc0551bf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 59.4MB
        • SHA256 9e50ecea5b8efb6d24062687aa9b4d6b313cdc63a1fcf8781b21dfa797463396
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 59.1MB
        • SHA256 f72ba0946782cbaf02e8e58e62f1f7329cc1375a46cc095d2d087c5dffd5b544
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 65.1MB
        • SHA256 66f80839db99fd3939b1e04b811769407517f01e9fc715b3d0a1a11220e30212
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 60.7MB
        • SHA256 752b2b40f594fb610c2aaf7cd105ce286e0d0a2d8f21ea063f237053c6226e39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 62.5MB
        • SHA256 a49ddfda4b689b8fa3d8460462d02b4242e6ba20d32bc418e3594e604d124243
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 61.3MB
        • SHA256 6b5b7b3e5cb7c43ac349e441d853b0c05ccffac92bd3bff3ce78b0f081682d85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 60.7MB
        • SHA256 38448266c30ff9f2035654e43f6752a1009e4a70252df5fb2e272572a106f04f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 60.9MB
        • SHA256 0f202d34faf042f72f1517dacf5ad1f4a2c8a8acfb5faf0cc3b2b827e273b759
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 62.1MB
        • SHA256 95c21f1fe4081a4c3cdfd1bf12935bc923c33a5a61e2c2bd958cc86d8cc90292
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 60.4MB
        • SHA256 039cdedaae65ab5357a79860a3c143d810a4818b918b50344ae3e489ed485940
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 59.0MB
        • SHA256 7c74ceb6727a5648468a63375d85fa21954318ef01b6a9ef9d53d5fab25cbf4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 59.0MB
        • SHA256 9639a6d868da0ff1d60efd6e9ed5b64a1d82b66151d61715b02d004f63b37150
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 59.1MB
        • SHA256 92c07ecb6681320f580d5a80f5d70884151b67468a36d3f4dcc4bab51c3b1973
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 59.0MB
        • SHA256 384c7f4e0b662c0d652cda9adc1419568301dae937c37060a4a09d7c96e10e1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 59.0MB
        • SHA256 a0f6b72675ef3a2ec198956cc131cb42fc5790d5f53d2ddb9a8faf7ba3fa0514
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 55.6MB
        • SHA256 7d200be590118ffe3df8f7525b878efddd2f6d04c654f2b408060effb902fd8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 51.4MB
        • SHA256 1daac203d072710dc90c6288ff90f89ea4082ccbef464c240280cea3ba47f5dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 44.6MB
        • SHA256 2dab40f329dae45587fa7138c5ad1fbcd6ed795fa2f7a5e3af162899808af47b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 44.9MB
        • SHA256 b4c8fd34754a2efb8f8e88f00e24e55467bf5043ef8244ca66a2801e7795a4da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 42.1MB
        • SHA256 6a4615a61cd779271fab1bd7023b653194b5144123dcff5f402332958cb26b59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 41.5MB
        • SHA256 a6a3ed9912cb959f0598ed9baa0ec13c22002fe0f9c4c7533077d6cc0f59cb5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 27.8MB
        • SHA256 79366ce48063b554860dce6bbf1dd72c2ffa646249b322c1bfb91488f4a432b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 29.5MB
        • SHA256 679d81e8a176cfc472bf767672b3d8a22d8a41ec9777205913bae0ddc4579bc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 25.5MB
        • SHA256 78c8758264ee82be1c817fa99309e310682678ad43c30ab2fbdcd5c630bd8983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 27.0MB
        • SHA256 d6c1380be056e9eef2ed097cb055e8354a2da744060fa4cdb513f1ddfe0c5af9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 26.2MB
        • SHA256 02db123bd36349ea2d87a5bea03dd7b59ca9b356c7067f6d6cc0a185a90ebc94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 26.4MB
        • SHA256 e628f0ed2edb99d06c1b2053b0568a5fb67fc4723c455cc1f876840cd097845d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 24.9MB
        • SHA256 b0cff196373aa134a9a34e2554f295ff4f2385e155eabb6038d161c51e2c7907
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 25.3MB
        • SHA256 fcdc76aea2a8b5cb73ad952ab7d398639da72542efc462ab8bc1e6710ca5e710
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 23.2MB
        • SHA256 4bbfcf75a79faf6a03310e750edcd851e1f4202baef93aae172488a3e1b04db5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 23.9MB
        • SHA256 7d3e896febe289e9e32714835b6ed6756d9a85343327237c4312297b14f1c809
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 22.9MB
        • SHA256 92b8c24eb4090298311951becce22940cdb11c24cf631fdf9c624a49deab5112
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 21.9MB
        • SHA256 9e2465b3e1968a9394d0c09bb8a84355cb1d2b14ee879f5167b61cdeb59f65cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 21.9MB
        • SHA256 a969b79ceff1b4e37d9f2d4f63eaae5b11ddbd72ce16c6eb010a373aac0dfabd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 22.1MB
        • SHA256 f70ae129dc8810c1bbbf1fed70c5fc7708f4a0e50ca59dcb260830742053129c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 21.0MB
        • SHA256 d51cd31964bf2be604ab746463f14292da6761f211844783c1e6a4d1d3fad117
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 19.5MB
        • SHA256 b6068c15a1d76186924ad1858a24a829e55cb0317cb77bca8dc4fd6375dd4a59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 20.6MB
        • SHA256 da6828f7a3ada632f96089ca5a496ec86389f27025581412ced3574702410810
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 19.9MB
        • SHA256 192794088c1735f510dc563b4dcb50f6e566c4a2959094ce213c1d11210c9320
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 18.1MB
        • SHA256 5fe0485cc90196939733df573bb1151aba3cb621ada90fcbfbed4532a84123fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 20.5MB
        • SHA256 3402905014679323dd0a97e22ac4ee90479c4e6586388b45d518bd6ae181f85a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 18.1MB
        • SHA256 d12acda158770b7cd88ab8616f5260f6a434adcf6444eea2ffd62b74b5220df5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.4MB
        • SHA256 9209eb7e9aa1a65026eb9d13f4df3facfaed9cd8395a073c06d93cf5880bad82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 16.8MB
        • SHA256 cd733e5048acef69a8cc84a1b2610c494e9be9c46c2d361d24b2323185960e25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 17.1MB
        • SHA256 edf7231aa9d28331a0edbb07f63c81285354a92eab7148e589ccf9305bdf17dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 18.0MB
        • SHA256 5d834ac3658c8b6b6a56d2ec5b48b602da0c5dd39757c45e5f94cdd7ddb700ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 15.8MB
        • SHA256 f745ede05232404e57e872a38f374b389303ec033bb325971d5ad2155cd1a483
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 16.3MB
        • SHA256 324ffda06a2d4e0a0bf47f77679d35a761125d7b66dfc5581beb8a5a07e943e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 14.8MB
        • SHA256 9f18d6e842f014eb1ee375e1f546f9b4483b1b79ee1511a21fe5ef0d85523b25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 15.4MB
        • SHA256 a1ca51b5d04b5035a2d2e7a332d0844e4e03cccaa8450b0138c91b39e88f04b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 12.6MB
        • SHA256 6c9e5b33e53e99c64ee9dcddd943b8a60ad686febfeaf92fb43513c60236ea9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 59.1MB
        • SHA256 2df702dadd888eef050f0ca02e8052e88eeee1057af6a84834498ea83a796f9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 59.1MB
        • SHA256 c2bc7e6077c6b349c33ddc816aaa6de28482a2e3203de6378ecec053308792e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 29.5MB
        • SHA256 07fbf55cebc43e7ed7708059d53f82272efbe77f8bc4a124c7f9854b780a7ce4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download