Overview

overview

8

Static

static

3

2026-08-03...wk.exe

windows10-2004-x64

8

2026-08-03...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 09:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_c59f73a1c595d916e2debd4b464e3c7a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 15.1MB
  • Sample260804-lt13wscl71
  • SHA256 6a29e2189f489e4979808229e1c8a0dfb8e4eec84afed8bdb6c0149b64643493
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_c59f73a1c595d916e2debd4b464e3c7a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_c59f73a1c595d916e2debd4b464e3c7a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1192
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_c59f73a1c595d916e2debd4b464e3c7a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_c59f73a1c595d916e2debd4b464e3c7a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4804

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.8MB
        • SHA256 03a6ce920ecb20f2a29b14cc9e90a861fd301d680711c465838ad604f37a7d48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 38.6MB
        • SHA256 c429e1fe03b944338ee3c513b65caa84ed6fdb325f2e54632c15ccfbcb39112c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 30.3MB
        • SHA256 1f6bcdf5894d3bcae4afd58d673ced3cba01f5a814889f8a212416fd64120a8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 36.3MB
        • SHA256 3e7889facb82c6007014bd281937791a8fd86fb9e9d2b9669235f18c1a8ce379
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 32.0MB
        • SHA256 693810b3b7440e83af22825fb7db7580d40c4fef530f111a2520ed587fe01360
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 32.5MB
        • SHA256 cb3ad1c29743d36121f723fa7e9c70802dc58f8985aad4848876fcc5d810b11e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 31.9MB
        • SHA256 52c2e8cd2d493afe8c18b41c2d546e3cb5ebd0a93f6dae1be772cc2d6c760cc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 32.1MB
        • SHA256 6a5fd1b332488d25c31346e0d43dc308532ada2f97bc5da1131819cd28f8bb4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 33.3MB
        • SHA256 77ded7a31f0bcee63b910d63ce28b4e4b3905dbdecc722e8aac14aa587d21417
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 30.3MB
        • SHA256 ebad31e40fb763bd7d120ce4f60c19074390204e91ce9f0db266f831dc246b64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 30.3MB
        • SHA256 7ee85173bce6a89c4571a32448f2aa912eb3233f7a0bc395dca4cb92cd54b88b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 30.3MB
        • SHA256 7fc17889b07a118c6769cac3f4641248f436baba99724cb46959c02a17bc3664
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.3MB
        • SHA256 76178ef9cdd8ac1d5e0206b24fa640ae99aa06398c34538fe61b9c1d26a73ff3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 30.3MB
        • SHA256 57f8083df68ca766f2b165dc1f0f37d5b434360738528550f221d782a240dabf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 30.3MB
        • SHA256 0f80624739cba2835c43c11eec3d514d311174d8280b87f64a16274de8181f5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 30.5MB
        • SHA256 9b48e6cb41a9e73d31382dab035ff07127142d4ce1eedf9a3391425892363624
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 30.3MB
        • SHA256 c6e41e35d97c0be3075c3b0ffd38fc764fe5f84a32c19eef989e732241b45d17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.3MB
        • SHA256 1e19b9aa0146783bc93db6bf3e1bbe3520d7bb2f8b5a335c6dda839b47d24827
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 15.3MB
        • SHA256 56871206539fcc4f4934415ce00111bb727f720c5f32eea66bfef91f3e1d61ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 30.3MB
        • SHA256 e2a081fb4946ceb1b5aace568028e85b1fe444a6134d98730c72ab442b139d51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 30.3MB
        • SHA256 ed2ad09a012258768aa40d8fd94d0b2687ff6497f7c4a0a48106e7a9485fc5b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.4MB
        • SHA256 559899d4075eb588a18f4733f6ba0eef601566d1e80e01451abaa28eeed321da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 30.5MB
        • SHA256 8a94d5134ea58ba19c7c560747c48e68033d58238fbc24fa4f72f05e46b1730c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 30.7MB
        • SHA256 e4fb5a31341f1cb4c2a1508bd1363a983058b6920d479a62a0d4db4176869fc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.3MB
        • SHA256 a777b9b0fd95206940a7e5a07b8e43dd46599b7f543238458c25c3287d63dc2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.3MB
        • SHA256 1cf8614527e5ef207cf03a7c6c265a3b2c43614e4a119fa79c96b7c2614beaf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 30.3MB
        • SHA256 a7269cddf316a4a99f1dce86107c6e2d2e8236c9b82ff91e3827fd071b366f91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.3MB
        • SHA256 5b7cae89b9438e4a0e6ad4fd4e3daa0387bcbe70b5ef5fe858d022f1559a8618
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.3MB
        • SHA256 fb9f8b3317ff919b07323a0e4ef9b82c5c4315c7e67afdd2f4c612be4766e736
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.3MB
        • SHA256 6ec00c19025f3f858156f732ffb5949239f59e7dbc07eb8a1621e80f76d6feed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.3MB
        • SHA256 b467a1c5efc73606b81173e86054da614b0733214bd51fe0bec7394044dff08a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 30.3MB
        • SHA256 301a52cf2fe6d163f2bea9196b146006dca01cb79b1ebbaa76bc83e755f5a5fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 30.3MB
        • SHA256 3f39fa8acb97326137ebdc38b06aeb6a774acb7b6fdf25707882561718fb2e18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 30.3MB
        • SHA256 fd94855d9bdc971ca44e20f0ca066a72898f9628ca989e43035b54274fcc36c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 30.3MB
        • SHA256 9dd882f159e4aae3f17531f420b7b8ae6be3d38b073e98611bb774f679995fe7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.3MB
        • SHA256 811ff85ae840f184659186c8548c23ac67c173e9f22d56b6e973a6b6f9db929a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 30.3MB
        • SHA256 884dab7ecc493f45eebaf424f9197636a7636f8cc89a11b7afc3bf8f9c363b63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.3MB
        • SHA256 8067d225e4981a2980baa2e03dbd34a7ed5319623614103ced0d5bb16fa9ca4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.3MB
        • SHA256 6b7d219ec5a602767c17f3ae84395f1f06f4877bbfa7e3b844f7f2402e98ce90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.3MB
        • SHA256 0f6d5a7719c04aa3b79e5b599104757ddadea1043713fffc3aee944d3e8f7e19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.3MB
        • SHA256 ca3f296b63d5509c9026afc836218199bface5ae0e0d566a6b2da8b8357e9621
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 30.3MB
        • SHA256 d7d443c76b88a5427bf0081aba0bf74f98756ae7f0931076a3d3c9b8d7342602
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.3MB
        • SHA256 f5393398079b4229cc16a3e7d70d2cc3a0d47f87b7be6d89973a6c3393e5cefa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.3MB
        • SHA256 4c3e6efd326dc946f1f596e2d6133293148f08d6abd70124a7dd9b675c475b12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.3MB
        • SHA256 6641051fba10ab46bcf81da9be16e56a9ab75b7462e1caed627b616bb1db766d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.3MB
        • SHA256 41eb76cfe3fe61ba507021596e875768852856907de6c44f61858b099e5c8bca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 30.3MB
        • SHA256 056f3eceae4b36e36726d2907fdf8c41f2886c4ed3921e4452fbae80ea795ea5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 30.3MB
        • SHA256 2df51fa269e45a79da9d345d5a016392f0198c8afd6d5ddc5dda46d984c7d7c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 30.3MB
        • SHA256 5b8a076e9906a70ae8fd335a8438587bb5882f4bdc64ee3918f0041d8f9bbc82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 30.3MB
        • SHA256 f58e7189d9da8f20c3c7879700b8615bfa5fa1f7d3e719b4bad41b18c935bc5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 30.3MB
        • SHA256 79e0ea047f93ecd0e95847483fae3e94a90a6eac316a11ac9daeccbff5553575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 30.3MB
        • SHA256 07078a89cf0854f684a3e8cb7da5b303587dd4251312ef98e1697059b36d90f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 30.5MB
        • SHA256 a069c55b997462bb6f5321cfa96d2aec82fea09d74e1812b981b66ffefbe6d61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 30.3MB
        • SHA256 9851168f8c0e43a9fa8fb72d7b977024018ad7c66c4b89edd0914b2af79e70a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 30.3MB
        • SHA256 b71a414535f7f6fb82b2d15cb263d17d80154192a020cb44b8c2241c05524dff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 30.3MB
        • SHA256 2b7788e6c19e40c9441578268f5a9ba9073befaf08d7e820f9df6dd988145599
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 30.3MB
        • SHA256 8bfe3f8dbb75434c749adb12026f7a5ad21962794e85e2f60fa8596349a3519e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 15.1MB
        • SHA256 6a29e2189f489e4979808229e1c8a0dfb8e4eec84afed8bdb6c0149b64643493
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1192-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1192-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4804-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4804-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download