Overview

overview

8

Static

static

3

2026-08-03...wk.exe

windows10-2004-x64

8

2026-08-03...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    139s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 12:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_40470eda74a54ebc9b225c198b435133_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 30.3MB
  • Sample260804-pgjjvsem2w
  • SHA256 2b7788e6c19e40c9441578268f5a9ba9073befaf08d7e820f9df6dd988145599
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_40470eda74a54ebc9b225c198b435133_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_40470eda74a54ebc9b225c198b435133_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4332
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_40470eda74a54ebc9b225c198b435133_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_40470eda74a54ebc9b225c198b435133_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1584

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 31.0MB
        • SHA256 1d45136823565f53ef09f5423032c25444dc78e70c19ace714486ec18f25fa16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 66.7MB
        • SHA256 4ff1eee47a4077d53033760fbdd0959e246d4457ebedfba44ac00c49664bed98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 32.0MB
        • SHA256 80e801d9acd8a9d11521f780a26323191cdec610f06681edb1ccc9fadce9920e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 64.1MB
        • SHA256 5386c5a2dcfafe1721dd9fe01c7dc2c835fecc33110c906c87073bb4b6789554
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 62.9MB
        • SHA256 0527ce9d762e13fc176390eb7915f202878c9704912ca929ff07e59c2b64f797
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 62.2MB
        • SHA256 8effb4fb979ea71b84d34e7d122c9476e45405d1ee2744af687df0a3bb40103b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 62.5MB
        • SHA256 a1b3237b0df78b211a898ce76d5fc75eb2ffa33194ed8580c7dac85a6dca2d08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 63.7MB
        • SHA256 de9f9710c209b96a7f0847eac950f963a6bb60d8654bc4483d77d4768306cde2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 62.0MB
        • SHA256 b7faea9cc617ccece391f62e501712f9bf94a4543adab2f7820a19f135e08570
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 60.6MB
        • SHA256 155193facfa1cb975795ccd489f568e708707ae0fd6962a73d1b67737c6076d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 30.3MB
        • SHA256 697ad79a250da6dbc15fc76d84f5f368aefd3d88c8d48e52c22ac9c46aeae8cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 60.6MB
        • SHA256 2c7f700e7bc84ffab82c91266c37ebe969e81d84fad5c0d2c4c971023e7ecd4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 60.7MB
        • SHA256 c307611d6e5340bc6a8a9335d7be0033b194216cbfe9caa0b520559dc701dc2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 60.6MB
        • SHA256 a5085e8da123a875e0c6ed4cecd4e0a2c0cf569bacb77224acac91a9118d8ec7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 60.6MB
        • SHA256 cc96e51669f06e02efad1824bcb15b449f882e1c4bf8aeb12df40c0e55e9a0a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 60.6MB
        • SHA256 126c89dd3fd1c401337da063adc2b227866c6f12f75e50c2736461e16186fc66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 60.9MB
        • SHA256 523204cd0a373d3b507fba81f9fea85ccdcdc9b21bb841e96833e847e39418bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 60.6MB
        • SHA256 fc9a9ca0ca90c053ec21291e782d847ba1a224c46211fc39c64a6a7e876bf2e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 60.6MB
        • SHA256 ca2b398fc5ceb43f16344897a6e319ce8c1c8267698594b944cfac456c448e88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 60.8MB
        • SHA256 8dea0fa57d0922512d802b5e2f5c381c5c329c1297c1943f9aa56b5e40a72811
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 60.6MB
        • SHA256 ded1f713b8e7e1b4e60bcdf747322048d984393c60af7343f056b4c0ab82fada
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 60.6MB
        • SHA256 103f6acbb01e9e2b396e04a4ec7624e721a208bd73be4fab8407928705cd96fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 60.8MB
        • SHA256 1b5f4adb61b9c3869950aac1ff8d317ad7728887c034585bdd744c4ffcadbb6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 59.2MB
        • SHA256 caa27538c895a3a7e328469facf36912d99c83b08107f8a6f8fef2b9472e5989
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 27.2MB
        • SHA256 9e8693c2ed9e5b39b473b36719e0f2bdbcb3594e556411f48fbba0ad2a699f12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.9MB
        • SHA256 6945e555d95ca7cd26acf4183d09b8360bccd318098c6575e7e7da7a444443a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.2MB
        • SHA256 75c2676da3b1a63a72577b9368b1a4a8b70befeda58ec05fb084ea5de84362e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.4MB
        • SHA256 2311fc13d4968c00187e07344649f2591f818599f6b1091ae6dc601d7fa21661
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 27.8MB
        • SHA256 2c1cb4ac063503884ad317e4b21cfed85a1ec0649e61736f3009ece61cd1f65f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 42.6MB
        • SHA256 33c707f7d02f8262077447c3cb07ac7f054eaf1e3f81ad707a34f059dfc16923
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 40.9MB
        • SHA256 58b190b497e3c69c9fb82654cdedfe9c38b8a34d45ca8d4b7de19f102f77337b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 34.1MB
        • SHA256 5c5cf8969c7fe33a36c202c3ccff74e40972e512ea4f07c7e5a5361da67f44c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 33.7MB
        • SHA256 a70cc91273e7728ecc848564996a81a29eb9681bd8ff29507ebec61c84906548
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 29.0MB
        • SHA256 ff5c7976f5462e3572528714949423c534cb266fbe485e09f2af6bb87be828d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 32.9MB
        • SHA256 e1f0b8ab44651d9ab59bbd3e206b134f5690b32216b6fd5aba5712f5434eb436
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 23.1MB
        • SHA256 b9dafb767f0485501df0bc6221432b163726b7289a88d8f4e4d3d691733dc6df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 30.3MB
        • SHA256 2b7788e6c19e40c9441578268f5a9ba9073befaf08d7e820f9df6dd988145599
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1584-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1584-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4332-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4332-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download