Overview

overview

8

Static

static

3

2026-08-03...wk.exe

windows10-2004-x64

8

2026-08-03...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    17s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 09:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_c59f73a1c595d916e2debd4b464e3c7a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 15.1MB
  • Sample260804-lt13wscl71
  • SHA256 6a29e2189f489e4979808229e1c8a0dfb8e4eec84afed8bdb6c0149b64643493
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_c59f73a1c595d916e2debd4b464e3c7a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_c59f73a1c595d916e2debd4b464e3c7a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2904
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_c59f73a1c595d916e2debd4b464e3c7a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_c59f73a1c595d916e2debd4b464e3c7a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4176

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 15.1MB
        • SHA256 792de869e88d184f8f05e9f57edfba3f1a7c1371c16826fa9f19d6226ec84914
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 30.5MB
        • SHA256 dcd8299ed94843402ce7e93fd5747e9ddc1b6edbebe959f8c2a8d4e4f0608718
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 30.3MB
        • SHA256 2a6eeadede3fc9ca27b1e0f8cde4be32390b488ee85338445f512283d071a9dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 34.3MB
        • SHA256 1655b008666d675e0f148da494435ccedc3f6f1122e74ca89c16d7128492bc73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 30.6MB
        • SHA256 a94ca96b4f26d7e147fb181fc81f1c1c54587f32ae0df27e379d71c7411d698b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 42.3MB
        • SHA256 031eadc2f9fb2206316f40a3fc8e3669f2bc82bd23806bde073fee52544a4bb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 32.4MB
        • SHA256 90e198d42dd95f5b394170759d7fb36a5a057154eb30fd57c1473ff24435af83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 30.3MB
        • SHA256 1f6bcdf5894d3bcae4afd58d673ced3cba01f5a814889f8a212416fd64120a8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 31.1MB
        • SHA256 b610395eefb4eaa02d60f9e2614ed173981b29c6def22caee461bcfa2168df67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 34.2MB
        • SHA256 cb6e1d3d7165d6e7aabd145cfd9ad5a902593ec18e88a4d0c695b3bebc9efe61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 32.0MB
        • SHA256 693810b3b7440e83af22825fb7db7580d40c4fef530f111a2520ed587fe01360
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 32.2MB
        • SHA256 0a4f40884a8ed0e5837ed149956bb48ac5aa1b46530ac1d173ec0d53b1408c6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 32.5MB
        • SHA256 cb3ad1c29743d36121f723fa7e9c70802dc58f8985aad4848876fcc5d810b11e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 31.9MB
        • SHA256 52c2e8cd2d493afe8c18b41c2d546e3cb5ebd0a93f6dae1be772cc2d6c760cc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 32.1MB
        • SHA256 6a5fd1b332488d25c31346e0d43dc308532ada2f97bc5da1131819cd28f8bb4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 33.0MB
        • SHA256 69f33591fd3690501ceb4177225a4e44bcbc5b6c59b4e8d3daa7f7a7b4d427f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 31.7MB
        • SHA256 f5c72334816e4d67190c483b4385ea190e3a6682cb7fea02da2d89abecbc667e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 30.3MB
        • SHA256 ebad31e40fb763bd7d120ce4f60c19074390204e91ce9f0db266f831dc246b64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 30.3MB
        • SHA256 7ee85173bce6a89c4571a32448f2aa912eb3233f7a0bc395dca4cb92cd54b88b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 30.3MB
        • SHA256 7fc17889b07a118c6769cac3f4641248f436baba99724cb46959c02a17bc3664
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 30.3MB
        • SHA256 49e94e181b8b1602c8cd41ad2703df8a79cb711995134b96356b98560bf337e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 29.4MB
        • SHA256 2311fc13d4968c00187e07344649f2591f818599f6b1091ae6dc601d7fa21661
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 29.3MB
        • SHA256 adfb428d67387d4c2b295a210592732deee1cdd4bf5641f3e27219769ab938ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 30.5MB
        • SHA256 9b48e6cb41a9e73d31382dab035ff07127142d4ce1eedf9a3391425892363624
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.3MB
        • SHA256 1e19b9aa0146783bc93db6bf3e1bbe3520d7bb2f8b5a335c6dda839b47d24827
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.4MB
        • SHA256 adc7828fb18e5d7bce940ee360b80a2db8d5167deecfb982d374b3e366a7ecaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 29.2MB
        • SHA256 cb4481dc037aabb214675b848413eb417a62a9fd701d0a1dc5819bccecf4cd09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 29.6MB
        • SHA256 f0c80c18570309ad3d75711ae2821d908fbdafbe679d180d2293ebef6fdae2f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.4MB
        • SHA256 559899d4075eb588a18f4733f6ba0eef601566d1e80e01451abaa28eeed321da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 30.5MB
        • SHA256 8a94d5134ea58ba19c7c560747c48e68033d58238fbc24fa4f72f05e46b1730c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.0MB
        • SHA256 0d766af5acdbaf58cb07a8822bce6143778805e37ff3e6b3280952521f9324dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.3MB
        • SHA256 a777b9b0fd95206940a7e5a07b8e43dd46599b7f543238458c25c3287d63dc2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 28.9MB
        • SHA256 92e2924ed6f5d1dc34dfa87a6ebc3cface73187687852fc97ba00082b13490a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 29.2MB
        • SHA256 3e8ef3e588d0f6817b7c24fa248f4a164590776afe9fc43edbc259e2fc262149
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.3MB
        • SHA256 fb9f8b3317ff919b07323a0e4ef9b82c5c4315c7e67afdd2f4c612be4766e736
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.3MB
        • SHA256 6ec00c19025f3f858156f732ffb5949239f59e7dbc07eb8a1621e80f76d6feed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.3MB
        • SHA256 b467a1c5efc73606b81173e86054da614b0733214bd51fe0bec7394044dff08a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 30.3MB
        • SHA256 301a52cf2fe6d163f2bea9196b146006dca01cb79b1ebbaa76bc83e755f5a5fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 28.8MB
        • SHA256 db598817af3d6d4ca2865e025c3b891fb6a83736bb68c5f60256bd7bdcad6962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 30.3MB
        • SHA256 9dd882f159e4aae3f17531f420b7b8ae6be3d38b073e98611bb774f679995fe7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.3MB
        • SHA256 811ff85ae840f184659186c8548c23ac67c173e9f22d56b6e973a6b6f9db929a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 30.3MB
        • SHA256 884dab7ecc493f45eebaf424f9197636a7636f8cc89a11b7afc3bf8f9c363b63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 30.3MB
        • SHA256 df718e98de67035f0a954ac49aa4818e1f42e065d299482a60b65350002cc3b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 27.6MB
        • SHA256 39af121dd59090e81cc7f5b9e41dff7f3b4db6b4a33a95188f22f002a40ada33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 27.5MB
        • SHA256 abdd766a95d24d35ba7bd4f75b021da2a2e2a639ba6f2045ef1cb9e90d587799
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 27.7MB
        • SHA256 e813cac37175795f7ef66816aebdeababd9581dfcceca67bd3b959779baefe73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 27.3MB
        • SHA256 8df51db8cae9b8bcceb788e3513bbc305648be8dc8b752d1876cf02da4b35562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 30.3MB
        • SHA256 d7d443c76b88a5427bf0081aba0bf74f98756ae7f0931076a3d3c9b8d7342602
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.3MB
        • SHA256 f5393398079b4229cc16a3e7d70d2cc3a0d47f87b7be6d89973a6c3393e5cefa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 27.2MB
        • SHA256 8ad1fb7a661085559163454cd79a1e3cd996c55066b0a48b4271b8540a5b94c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.3MB
        • SHA256 6641051fba10ab46bcf81da9be16e56a9ab75b7462e1caed627b616bb1db766d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.3MB
        • SHA256 41eb76cfe3fe61ba507021596e875768852856907de6c44f61858b099e5c8bca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 30.3MB
        • SHA256 2df51fa269e45a79da9d345d5a016392f0198c8afd6d5ddc5dda46d984c7d7c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 27.2MB
        • SHA256 9e8693c2ed9e5b39b473b36719e0f2bdbcb3594e556411f48fbba0ad2a699f12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 30.4MB
        • SHA256 c8f98831fedc19be2e5207655fde9a27467c68bc3e4b86903134fec6a6ba5d83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 30.3MB
        • SHA256 b71a414535f7f6fb82b2d15cb263d17d80154192a020cb44b8c2241c05524dff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 30.3MB
        • SHA256 2b7788e6c19e40c9441578268f5a9ba9073befaf08d7e820f9df6dd988145599
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 30.3MB
        • SHA256 8bfe3f8dbb75434c749adb12026f7a5ad21962794e85e2f60fa8596349a3519e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2904-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2904-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4176-28-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download