Overview

overview

8

Static

static

3

2026-08-07...wk.exe

windows10-2004-x64

8

2026-08-07...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    41s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 00:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_8f1a7072bb2ac652164fbb55fc9e3ab9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 22.6MB
  • Sample260808-bb5y1ser5w
  • SHA256 a604149487b6346351f7d061044e37734f96c4d5ba63c584af572231746a1cf5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_8f1a7072bb2ac652164fbb55fc9e3ab9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_8f1a7072bb2ac652164fbb55fc9e3ab9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4716
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_8f1a7072bb2ac652164fbb55fc9e3ab9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_8f1a7072bb2ac652164fbb55fc9e3ab9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3336

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 22.9MB
        • SHA256 b8e4236cabb1c9ba0ac2de7fa9ddc9ff5a9c03d14aebb2ecb9a312aea70f5b75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 45.3MB
        • SHA256 89c1144c8abcfbc6ed6a97c5ffab2724c68296c94dbdd4d3e1518de3ce46588c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 48.1MB
        • SHA256 c3306383f482844a701998070f7cea412dc719d57540b2bdc169c2099ba6c987
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 45.6MB
        • SHA256 f4f00414a6189897f0d690044203aa9d0a0d4fa7fe7424dd6dd5fec2a4ab55b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 43.2MB
        • SHA256 7e648b0cee69230615ead5f241af6a9956a4d9a188d1452efc9f969f3676f282
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.7MB
        • SHA256 1c1080bd1f05eb1b87cd7b49206c04a7d2ca9da9d94a7637dceafacb308518e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 41.4MB
        • SHA256 c2db075b0273b13a5e87d240dc5a46a24ab6b009aa3d58c2106b8d23ca6a1b5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 21.2MB
        • SHA256 02d90050c19dcdb9cac4d0163b4f356cb02775e66fec22cc16bf7db1f905cdd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 32.7MB
        • SHA256 cb32f070140ec123a756debe04fb8dd41131de5cbd8e96917fce16bea57a1489
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 36.1MB
        • SHA256 3a3f182d4bc112422d180b2b536986cf24435b3417653af704c760aae1f617f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 36.1MB
        • SHA256 939c9fcf9741735ed23379b6a2843f80d622748dcc44d1c89690684c744ac3bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 33.1MB
        • SHA256 cebfc3154e00d7a17e195ffe4b7df5e5891a35cef9da223e9a975a6f0eeea33d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 34.0MB
        • SHA256 5e440e60ab2fbf9fccacac15c3604893b9346d7c054c5d12885fc7c88f73b5b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 33.6MB
        • SHA256 006df850cf9467ec0b256ba502fbd18ef5e3726a0b4fa57a40b31131c1662453
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 32.9MB
        • SHA256 24e9fde8af7e425898a8508a78be6669b6004a05025a878534851c3a2dc4bf1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 31.9MB
        • SHA256 be68bafac0e2372198fdd29c97c8cb0a6b2d6acb549ff9b56f54cc32fa399b60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 31.2MB
        • SHA256 976f7f4752b58d30e49d3499f32cb8b0dbc745c6ce0a2c5da2d5fb3c84d2d557
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 31.4MB
        • SHA256 a4dcab0edb958f13e5d3039c480780e88259ac456e4f7d97e87dff67f8aae2ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 29.8MB
        • SHA256 f3270ed79cc9e1509b8c59e208c2bd08dadf392cd6a169b8068bdbf13bf6e9b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 28.8MB
        • SHA256 e45207b5c3ba407e77d724fd08a7fc3cde079d8ac075e29dc92d67ba9815223e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 27.9MB
        • SHA256 8d596308b2967d2d7a9129c4cba8a488a88412ca0eb5843e602c6c0fff3f71bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 27.8MB
        • SHA256 85df37d1277d4033cdedd15ac689f22096513416055882f38bfe81e7411d3889
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 28.1MB
        • SHA256 7cec1f924fa7834d8ef91532530cf2afe248f098465943a0421533772c3e9cbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 26.1MB
        • SHA256 85680342f1e2c8b983b1c6133da2f495f597860909a96a53fbbc512069fd6ccc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 24.5MB
        • SHA256 b7a1c1f6d25c22fa84e4793bf5fc2ba07289d9062675c9090fc2a0eda8346b7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 24.8MB
        • SHA256 288d75537be8a17ceda71180a34740e3e8b040cc082038f30824c1d28b99071b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 192KB
        • SHA256 56d5b720b4307ef448fb38ef6495ea0a6fb25e8bfa8f9c140729b820c8e0cc1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 24.4MB
        • SHA256 183e3d0c98acf619fc06a5d1ed3b4d21d64b05267d7afae05d28c4496c2ea6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 25.2MB
        • SHA256 8ab8c80b81d8282b922f3f3f746bae4972242a28557ad2739c70b1a94a7e9032
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 25.2MB
        • SHA256 5fa2da74becf060ea2579bb6bdad26371f265e236f54ada2c85cdedb555e5193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 25.3MB
        • SHA256 1c497c3a31b7bb96de353b24b2eff5dff70b10166d27217e4bdc09b5fdcd203d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 23.9MB
        • SHA256 4eae2bd8a760f36abaeb11fa8a762ed473a5d50b8950b1fd44566fe197304c80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 24.7MB
        • SHA256 1b6b91b82d9bb3417eeade17d3d6a03f04490b148810a4e31e49296e487e9a87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 24.0MB
        • SHA256 6c3b5aebe046f8b4e32967e9d942349c9b8890e3a0c090009fa69ec796f68e10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 23.0MB
        • SHA256 d78f0c28741eb86cc3d6669a2ee89c6514723150fbbc402fe1b276c83e2414cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 24.9MB
        • SHA256 d56a511631cdc6216e6ed2d56dcc2259899d1c436674e44cc78dfdc100f026b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 23.9MB
        • SHA256 2687229bbe26e7c2ffb06caf3ee7e1f6aa21e64675bb22a1ad928e38b5e2fc4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 24.1MB
        • SHA256 14bad4d6a1b8f2bb076fb989b13cb4dcb011806bc958c5a4d9efc1f2c1ef2935
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 23.5MB
        • SHA256 8ccf0402d05c97431f952a29c05f4f9b930830c89fdd0db52437b2ec9045ace1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.4MB
        • SHA256 56f6d5eb1321cf9d615860f981aceb219b3262aba9a865fb88ec942df7a509d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.8MB
        • SHA256 b0ebc4c22f646391616ebfa7cc82264e1d7f571343fc8e4032d46b5ca9662668
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 23.2MB
        • SHA256 108c0776e335d1bbf3145e842bf8ac0ff5cf1237b36ac63b69296b792d683f46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 23.0MB
        • SHA256 dd13333746666456ee2b4c06743646ca1e8a52084f281f77be9279c1abc8f2c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.2MB
        • SHA256 ef86050a152218344b3bd9b03e702f2cd299171fd3dedc123e49de2189e009dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 23.1MB
        • SHA256 af77a27cd2e8a9b863f891f4f4bfc97779c05a03aeb05fb53b3c92aabea39bc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 23.2MB
        • SHA256 4682fb9217b6dc01dcd628d04c81fc97a20c1d3ecf8d1a464434b8cd06effd6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 22.3MB
        • SHA256 070938991446efd540febd60f7708fd1a0e856f1361b060ad49ddd7180fb7c87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 24.4MB
        • SHA256 fbaf336c9bd0a1e022faf8987d17efb0619a5c7a1677aa6a353e151f4afb7f45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.1MB
        • SHA256 2f9a35a3fad87887f0e856bba55e56e3b1e388e688348a125041c1c2d654d8be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 23.6MB
        • SHA256 973f75f26696aeab79bba700780185d567f240614a1dc3f79f9884a05942a0d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 23.4MB
        • SHA256 990e9814b85206f51705a49ceb97ea916488f6f249796ceb9cf6821b6680f009
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 22.8MB
        • SHA256 be7178cec996c54f33e39a04d4683202c224e5eb9874a360c69a7e3b68ec3e8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 22.9MB
        • SHA256 733c1e90bea66a9ba81a9658a3ac790159ce12b100c167b70b32414f00d2f343
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 23.7MB
        • SHA256 cd8dfdfaf0c02f2ccd7fbff42ae981bb249f78f6fccbed6437d1148d69d95314
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 40.5MB
        • SHA256 e62226b53e1f3d8cf07b8dbae43b8479e14d2096c178b05d843b0bf48aa2abf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 41.4MB
        • SHA256 720e23139250dd6cb168cff1963d689e4883a5b2be3c9f5a8a3eb5b828371375
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 37.9MB
        • SHA256 3a411d4e42b06c118d78bdb295124c226f92389f351d65b3156d2173effbf730
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 36.5MB
        • SHA256 421d1908e98aceab3d949b0ebee5f7294e7648c7ea5afb1400fbe12a3ecaa90e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download