Overview

overview

8

Static

static

3

2026-08-04...wk.exe

windows10-2004-x64

8

2026-08-04...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    30s
  • max time network
    137s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 21:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_1be7c6c6129d43851bcc8e43405caa40_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 16.0MB
  • Sample260804-zv8q1sysax
  • SHA256 c9d18c80fbd3bc42bcdf0af7046346261187d6d9494ab0f73cec63d4058979aa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_1be7c6c6129d43851bcc8e43405caa40_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_1be7c6c6129d43851bcc8e43405caa40_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4288
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_1be7c6c6129d43851bcc8e43405caa40_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_1be7c6c6129d43851bcc8e43405caa40_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4732

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 16.1MB
        • SHA256 f9363a04ddf43765d9ae8dad5f4a513d2074f4aaa6fe41960683a7ce4fc1ff23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 32.4MB
        • SHA256 ace2239a5e67a1a5789d3471fa3df3ba661ebfa07d7ea5be7371f8ead5d1fead
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 32.1MB
        • SHA256 63d14ba6e0c3790549c8765bb87800f4a93ddb79824ec62b4e406bca8498c4a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 36.2MB
        • SHA256 0aead3e1c626275c4d0b9a13fe5ce372336ce5d71f6232bcbdb0f0dfeb95541c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 22.9MB
        • SHA256 66c70b6610eca161e39eedb085d4e511fb8db9120f1d4becf5a20be4edb495aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 39.4MB
        • SHA256 f5282f13b7b9e5e3c88c416adc14885eb8d064e00576a8e99449bf058d55079d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 34.2MB
        • SHA256 43204b8e908ebc971bc81a7ec67e088d689b5d4d0fe6e84b4d33187354afb856
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 32.2MB
        • SHA256 f9c7a3ce9f657b0512274c23dbae03a9539ad333841a2e31e481fc661349467e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 36.4MB
        • SHA256 1f32188f1b34f1b5900bcbda21a8dadf488ed3ba95904cfed0d93ef2388fbe5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 37.8MB
        • SHA256 646ba2c59be4ae2074672e1984f8bd71d8c0b10466f041e88028a4fe194f5a11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 33.8MB
        • SHA256 a2c60ca33e7e906354f7fb5276ec5f904cae5986fde9fbad5d0d10681b55081b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 35.6MB
        • SHA256 90ced15095e19b1ec33dc4280c560102e4317e66dfabf564b7251a07d58859a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 34.4MB
        • SHA256 9536c56f6c98d251f28dcb47a3a70f12fe9ec6622358ef762df80c5fca97229e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 33.7MB
        • SHA256 be6732bd5c2ecc444de105d8afc337852d49a4ccf4757c065a13e568c73162d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 33.4MB
        • SHA256 7261452b5f4db47d23d63f9fbad217f7a851ecae05cc70f9e7e1cabc0c854dc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 33.5MB
        • SHA256 c69f5b898babeb1c1e33ba0d6af532ca0a02516f906761e9dc1c7c42c13735a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 32.1MB
        • SHA256 f82936112b38eb2a606a642c067099b59366a3b0f787c1239e41bd0a4eb8133d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 32.1MB
        • SHA256 760ff59701983ddef46a1ef41c685764a3a00a8e2353a8eca951df985e84a57b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 32.1MB
        • SHA256 7cfb46a8b8483a74a937cff648e4c8281481a63ff3c465b6a46126b469242ae1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 32.0MB
        • SHA256 8181d117e400b4c7afb4a1681d7b77da39c87067e2da896be1d65f7baf436422
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 32.1MB
        • SHA256 13f59c9474481e66eaaff9cdc5ad0c357cccf6dc8ff69075386ae30bde77367a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 32.1MB
        • SHA256 cd6fc7b9049786fd7d42564ca722c3debb3301632ae4fce09cc61cfb6a3a3fdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 32.1MB
        • SHA256 9313ebe250d785578b335af8e008c09d660dff2160cee8024f692d57aa9d9400
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 32.4MB
        • SHA256 f7ab831531a856db16e8f100197917c76ef753a6ae25b254b20cc98e46218fcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 32.1MB
        • SHA256 3355248d7c41c83b7a8091e1d91c5aa33af1ea1b34bfc444e9ead01b3f5c63b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 32.1MB
        • SHA256 5441e071a2b769fb90783b54e89c15154705149d9b190c565e8b4993f2f773ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 32.1MB
        • SHA256 7efbdbbb0ba3868484c4132b1b9a90574ba9ca1f0039ff2cb197dcb0a64f468f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 31.7MB
        • SHA256 d2f0908abe9df96c82d1924b427daa0029d6fac48e028ef12d2dd3377e53c25a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 31.6MB
        • SHA256 933ed12ba7d6f8fb10ea51bda03391d165d7288f4374d35e675e2784714d4eac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.0MB
        • SHA256 157a8b66f365df8a6ee91e7fe1b5ddb5f8effb31b7c10a0fa1a1048fa250cf2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.4MB
        • SHA256 1188fed7b7265d651668f0f304ae2351c193b3e509bb56860fa7f1bfd09d4d74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 31.5MB
        • SHA256 cfc6c38c0925db39a65638e7997b66654bdc75670f18fa47d6db64f41f688cd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.6MB
        • SHA256 214afd840ae230ec1cfd74aab6de1481e81dbd16b33694f2a1436884b5a7ff6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.1MB
        • SHA256 53186d0421937b98d8be1b75311f75b12cf445edbd49e6cf99f7b078f034a9a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 29.2MB
        • SHA256 874694b1c365bbedceac1c828122ba9e42f3002c9dd57be76115405fe36a403f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 27.1MB
        • SHA256 49d36dfb8bf91b8e22d762f67b88f083a430d7559fd6e619ed23ffdf332aaa46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.5MB
        • SHA256 f726b26e5c372e2d0c0211c0a8cc72cd7e9bd95031899666ca38bec56335856d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.0MB
        • SHA256 9d79aac4878b1f1fe6ad1b39cf0077f8492dccac9c885a39c23900d19214f13c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.6MB
        • SHA256 64bb292be242809e16add967d0314517acdf9f8627046cb748798105161fa39c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 28.7MB
        • SHA256 11f2fd7e98056378c7c321fd0d88328727787679d6edf41c966351229184086c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 25.4MB
        • SHA256 66cc195054b23747a021262a312e5d074f4d9cc39042648081985b33c016ba1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 29.3MB
        • SHA256 03f5d6546e145f92a2e7237705434cbccae0da77e365f379c780fac58efff3e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 26.2MB
        • SHA256 a8a859984cd9c441ad53f80b9569c995740241e2b9151aa647939170c05bd151
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 28.8MB
        • SHA256 a22ec2b5c246d469b3639df396e8d5b33ee0939d3f2da1b41eb26f4df33d768d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 26.9MB
        • SHA256 0478f992e61a65d754124dde4eb238eb530a29783b3e8e82ab7ceb77d5beaa8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 29.4MB
        • SHA256 0ce1411f2c0d6f1f53691a5ef3815b74dcdb7a3ed9a2088933c1320aae5b1de5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 26.3MB
        • SHA256 81d36ae79b72f23ada80f77d6413c4ca344810a37a51e6a15a4eb229e2e4c057
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 28.5MB
        • SHA256 220ccdf9e6c2b8b831e88ed52280f8c007d1353efb529478439e75e389b2bca4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 26.1MB
        • SHA256 675508ba8a58b3d445df03968481284f57b40b73a322346cb16a512d6c297a1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 28.3MB
        • SHA256 298f9d910eabc31fc56463a6df1266316851a7ceaeac389d55f84249bb036848
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 26.7MB
        • SHA256 b90e068c702316a3d43487040dbdffa3384d59e91285763a2c04299d97006384
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 27.8MB
        • SHA256 6524f4c06db69089d4cddc66250e2a964b813caa78b91eb944a41baaaa452082
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 29.2MB
        • SHA256 a7c2646cc8a571d2a9f5429c074bf76347712f43880d43ee5ea74b25d05c76f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 32.2MB
        • SHA256 29ccf094341156e6924db2f60f8092c1604c0594849e5f6b4e88bc06c52b1865
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 32.1MB
        • SHA256 7ab761569f6f7cfa76e333e64170558b997c19b27c710c0b674dc7649c62ce8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 32.2MB
        • SHA256 30c4de751ade50ff97efa0fe04cae9b5993047fbe5611de42fcfbcd0055e0197
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 32.2MB
        • SHA256 b5750733806e3531783631bbf7b519ba57af36d6731129b2371ddfd513497553
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4288-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4288-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4732-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download