Overview

overview

8

Static

static

3

2026-08-03...wk.exe

windows10-2004-x64

8

2026-08-03...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    19s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 12:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_4b7f04cd9b949509cbc1d953a571d5bb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 21.2MB
  • Sample260804-n9masazape
  • SHA256 b5c72e54831636c36314bd5ddbe38a6386ad381e1c8f37e08539ef01cf2c9dd4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_4b7f04cd9b949509cbc1d953a571d5bb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_4b7f04cd9b949509cbc1d953a571d5bb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4324
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_4b7f04cd9b949509cbc1d953a571d5bb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_4b7f04cd9b949509cbc1d953a571d5bb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4876

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 21.7MB
        • SHA256 9d088146721c685c9942bbaf6dd53b1ad27f5ab59b5c9be7716d865a74c6c126
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 21.2MB
        • SHA256 b5c72e54831636c36314bd5ddbe38a6386ad381e1c8f37e08539ef01cf2c9dd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 21.2MB
        • SHA256 cd99255657361b5ce8bb34098c169d6424430581e58a42ab1c645f34f8badb54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CloseDismount.asp
        • Path C:\Program Files\CloseDismount.asp
        • Size 22.0MB
        • SHA256 c4d2d379b5f4f30cde1040f2f2766d3bf70adb6ebb7c034b4d6e88259aec1b7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 42.4MB
        • SHA256 25b59922adcc489ca315fef48335d357ef6016ba8a0b4b67363238ae24b4205c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 46.5MB
        • SHA256 c43dca8a18cc7463cd86857d7b81f1672a362c2ddc99c2a93228f1775019f9b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 42.7MB
        • SHA256 a73476d84444b051d1a4e3a8265a16426e18b8f0e1c7ea17ba91a476499d0cfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 50.0MB
        • SHA256 afd72b3c25a40af11d3ff325f37e09879281b397a3db4ad24b7e3be20a63bf7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 42.5MB
        • SHA256 a9e1f3a40905bb6607f1a3d43c444fe5e7784e297698d99d2ea68877fc30e52b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 45.1MB
        • SHA256 26bb8f9c3e019c0e5328e76c3ff54a3ef72a9d638f259daa0e48ad867bb854a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 42.0MB
        • SHA256 69157f5492cba5a0cb9e964890b11dec192d583e58e38de0e593e0280c3841a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 43.6MB
        • SHA256 6936dc81977e324f882fec9767e988570b96c090e3ec91fbeed44b0965eef712
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 41.5MB
        • SHA256 1d6cedf092258c1612df24c1caffbf904d2a11658d7d901d876a4c0763c31845
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 43.4MB
        • SHA256 fc7e123b108ed1eda8708d90c96ffb71fcb27f3cf43f0cb81c75b432f7e71891
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 41.6MB
        • SHA256 7324a55fba873292c0bfcec19d21bd3e674f68d4a33adb97381cf9deaac251cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 41.2MB
        • SHA256 a3ccc7700c2067224f4c19d8d935807aaa1665b8548dc8c1fc126d92c73c74a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 40.9MB
        • SHA256 2d04244a20d654ae9e9ccc0f11b5db4f69689fc67f0573a8c71461abd1ae9ae5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 35.0MB
        • SHA256 fe779d7161f70254611539a0df7c897c577e7587f5391789284d5058fa59c7bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 37.1MB
        • SHA256 1ea6b79e128a44ba5ce44a7c052f2c7dec676fec019ed8a8b4cd04a3e4a88474
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 36.8MB
        • SHA256 54923f5532eac42cf355ad0aaf935961c9edd5b68f4ca7a62d1ce97b8ee8e301
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 40.1MB
        • SHA256 8f698306d84e4a3ec960b2e59ec5b28d8c15322efc2f87ef7af844a4b664e1aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 39.8MB
        • SHA256 79ca10aa621d81e1bf02a96a6f8bfb540c54328f66a07943b4a4f7dc3ef10a87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 40.3MB
        • SHA256 d1e54a752343255dde1efa03c30965b2e6ded03ae22fcc143e2ea25bc4a5090f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 39.1MB
        • SHA256 09a8bb4b372e45683bc7ffbcaf7a787d02decf6f47d9a542f9cc2e97ca9f1a5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 128KB
        • SHA256 018b597827351ef5fba9c0e1d321cfa9b45d887ff0f8d5607452eb75d8626cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 35.9MB
        • SHA256 f763cd54893289c38686f16c31619d30673c5fd98e5d938f2f3839626fbbcad5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 33.9MB
        • SHA256 558bddebc2b33e971d422c1d9203a81339d4cfbaf2ac0593d62f4805108be369
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 32.3MB
        • SHA256 81fb11078899deb305e1c3217f1ff26efbb9520857dfff1c059ea068d24389a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 36.2MB
        • SHA256 50774a8a2954cfcc90549eb0f7c158fffb03aaa8c70de46990789c7a71573d8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 35.6MB
        • SHA256 c336e16c75b1704056f296a9e3a41570ac738c5d5cdd2f550a0e2512f98dd069
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 31.9MB
        • SHA256 f7cb0e9e5fc24c75525f861d1ab19adab56b721824e160d3bf42263c162e50d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 35.3MB
        • SHA256 54cecbb84fea76748272481f30ac1b14cea8afa447c9cbc90f2473005d7ba7b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 35.2MB
        • SHA256 50b9fd9be49a7b42f1431f9fea62ca2cb752b89fc9df4325298a8aa63907fe6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 35.1MB
        • SHA256 ee9e4a4c8e33b01b9d541f8bc84f7abc26e3ef97c792617aac45d220604d38a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 31.8MB
        • SHA256 42ac037b71cdd3669662ff9ef5dca2164d4ed13047d98a6405a01b848b58b37b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 34.8MB
        • SHA256 0c478cfab558a082d952f1f499d31557b664fa9f81108c977e8d5bd572fa9b6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 27.8MB
        • SHA256 d3e57e364537b294ab5fef6b0ac86d3c2aefa436b00e6d9f7e7f4dd90d8274c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 34.6MB
        • SHA256 9650237e3d178596cda4d11af523192ea2c844289599caf17d057db0f2e34f06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 31.2MB
        • SHA256 3ec8af24816c7210c2a73a2f3ab0c8c57401908435a120324bc0a76536dce509
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 34.4MB
        • SHA256 1222146f44be2f84cee02b48becc184ea68403074c8684e8178b7c93e6501eeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 34.2MB
        • SHA256 56bcaf502e0ee69d45d7019911bed166050b632fec8a99ec3b39428acea576b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 34.2MB
        • SHA256 13385a334301191544e703e8e6578f7b30d7b35ab4ad6ead0d3741bb7f14d85e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 34.1MB
        • SHA256 da095e4a773c1581f7c62375f84bc47dc1d7a52536d3aa32a37949fd9d27a8af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 34.0MB
        • SHA256 3a2829c5389369c7f5ad18c207465cb704c12be4e1d56743f9570727933b9a68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 33.6MB
        • SHA256 b0d21e824ee0764f7275d7a65dcb3ef2aaee1c4eddbbedd192804ede56317c99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 33.3MB
        • SHA256 31c7a76cacb2328af9f947718c773e1c0db4a18305e1b1b07a5c3d9d43de1fa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 29.6MB
        • SHA256 d948546a8c52146dba69cf8b832e53a7a4c68390ab636d3cc743d075b1bdf242
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 32.8MB
        • SHA256 faf968d1de9b15595c254861991907985e67346c6627697068c7eb669d53ae5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 32.8MB
        • SHA256 36b477dc6db4ed19b70188bf46880bb4e920728eaadd19bb7c00ea8d813b26a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 32.7MB
        • SHA256 0ec7b3ee2b06b2f81807412cc69e420d348b66e5662118257ad310cac347ce43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 32.5MB
        • SHA256 56a63ec8843561271742fa700ac33682d80f2d1792273b673d2e6c5b5b90dbb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 42.4MB
        • SHA256 64187c62fa02c53d7adaa864066164c12a5a7b2127e61d100b4658f43cf6b57d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4324-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4324-30-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4876-48-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download