Overview

overview

8

Static

static

3

2026-08-07...wk.exe

windows10-2004-x64

8

2026-08-07...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    23s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 01:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_54df1ab11fcf8193ef18f27c15a59a46_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 22.6MB
  • Sample260808-bqs8rsxdja
  • SHA256 e74ddf25f9d5a10a51be5412e1a0e7c4dda630d8ebb0946796516f0cbe4e5733
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_54df1ab11fcf8193ef18f27c15a59a46_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_54df1ab11fcf8193ef18f27c15a59a46_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1204
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_54df1ab11fcf8193ef18f27c15a59a46_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_54df1ab11fcf8193ef18f27c15a59a46_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1140

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 22.9MB
        • SHA256 e47c54db354cfacf96f437aa99a1ebd713e8ea3b88776fa57c9b3bff6c27200e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 45.2MB
        • SHA256 af652d95ef70e1e3dcb4a4966d2e3f44aa6d47920812e5e4c3ffd6fabba7673b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 49.3MB
        • SHA256 82be841a5165196cf834c6fa85478bf5585fd91c15ee40163d67fb6425a150f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 45.5MB
        • SHA256 3a73a4782edf48ff96e378b840279a6afdd58819feff95cf70d54d9df45fa113
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 53.9MB
        • SHA256 d45ccb5f719f5575b99cb801a92899fe9b347082c35798902c71696bfcd4084a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.7MB
        • SHA256 5e5b4323a5bc82d265d3039e64757d244e19ad0a886e2bc946e4bc34c60107d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 45.3MB
        • SHA256 2e21fb7eb035252dcd747e72ff34333931920cfda37d00c8fa2bc8a4cd06cf04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 43.8MB
        • SHA256 ed36e926a0438be81a9310a2eb2a7decbfd3598490d1a0aa70020f5f4e5df182
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 46.9MB
        • SHA256 72e94d52e4311fecb2f173fced473b766f278ca5896509c3de1f0cf6621b55ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 41.6MB
        • SHA256 d84aae4cafa54585db0df016d19e0c27a3499a6250e5d9e38bb63adb2764ff02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 44.4MB
        • SHA256 79e77347bf3a2bdac03583ed92570dc1e585dae22c113513ad9659f53df7278b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 38.9MB
        • SHA256 8c52f42b33d5ee339eb7fbfb08492436030cda210d8612f7dd0b825b92409c54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 42.4MB
        • SHA256 604b3b729a27da4150cac4f537df05f402c914718aed1ff6e95e64964acc8cc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 37.9MB
        • SHA256 ecc72da5a5225d338bf5cd243396f410a547f268eb12d95dd2b6ca946bf55c25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 39.4MB
        • SHA256 688b7f47ca1c1547e30bea16b1f17ba43d4da9034a444f8a8340ed9d9d6bbb4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 256KB
        • SHA256 6adff2403606f3fae51ba272308ce91c8124c63f116c3d886a5a38b4ccbce497
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 38.2MB
        • SHA256 655a77ec4d7ddc46637ffb7487ba8ab3360f66d0c072dbfaf23f696e22bf1356
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 38.2MB
        • SHA256 b8a584b15c1eb99c8eda0099dd749b548c777986c1944a77d8c8c6dd8606483d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 38.1MB
        • SHA256 23ec666ef41ca4f4a8a58df3df7f5b01edb03b453392051e68d8251b8acf3def
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 35.1MB
        • SHA256 7c9604f50e9d7e825c49d8398bf1b48db3caf0aef218b20086021ed9374dc8b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 34.1MB
        • SHA256 2bded79bcb536744befd6bc734421d1e9836c0bc4c5511be30e85ee811452fe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 37.6MB
        • SHA256 e6c60e999856173ee101e916aea71b43225a2a50b158b8e4889585c3da1a9b04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 37.6MB
        • SHA256 fcc153eab89f8118e2e3e50d56719c26bd8eac2b3f945a6f9e268bc24873ea98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 33.6MB
        • SHA256 838643f77a4d6fc6beba6d7ee5d636f84150c6747c925e8f83ff369b1071fa78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 37.2MB
        • SHA256 0a25f91d84eb154a93d5f77ee2bc4f537b9f65c81eb12f4e9bca24477e57aefd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 37.1MB
        • SHA256 a8235f3001712ecff8411c8d7d480032c5f6060d20b72b4b54d3b46c5dea3028
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 37.0MB
        • SHA256 98092c58282208f7a52ed1c320fa416cfb26a239545aeafa67740c069c6f16d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 33.2MB
        • SHA256 fbc3e91f5f0c6c1356c619a86e4af5a2cb614914a897cd0c823ad9f823307b15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 36.8MB
        • SHA256 a024bc92fc7b84f0aaaa642feffe9fa0a852238f1adcf763466dd845ebc443b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 36.6MB
        • SHA256 93ee18e9317ee5b9c7482bb965d0f97b04a4ed926b8238687da54db527373a44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 36.5MB
        • SHA256 eb1b12a5f13327028220ae67edd05c94486989f2e96ea3790b3ea4685b16062b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 36.4MB
        • SHA256 5987b634e68d86d5d8bcc4c0dbdcad670800966985a436ffef06bc0cbb042670
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 35.8MB
        • SHA256 cdb6d62fc81355354383f37e53d5b3dd8c795ec392434eff4f5a1c8b90ad7879
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 35.2MB
        • SHA256 641ccddf5e2070dc028be4ed8f0cfe2d26a7c00a495925afbfda3150c32fe45b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 34.6MB
        • SHA256 147970b84ed2568e1324aa109f32c95180059746d75ce221e2ecf6a318671b40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 34.2MB
        • SHA256 d60b6737524aaba5ccc06a5f6dd0c4aef38c5de4929a66cc08f33a91339e75c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 32.4MB
        • SHA256 139cf96e3302d1b4fdae680f9e3e4d25f64125a11b8579255b20ae2e69cb268f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 32.2MB
        • SHA256 aedfab7791ecaaa2e0fcb4fbb8a9b2600bba391669c7bddbab4787ac15aa8c68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 32.1MB
        • SHA256 9b748c11b126ccac00c3cff41fef0ac70abadff26e6ef37f70779d089e4e83a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.7MB
        • SHA256 c4ff97422b940ea17e6c72959d80919fec1414702b80fdd43684e04563c058a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.5MB
        • SHA256 e2dda6b11bd1286b088a33b23af6e3e31d9d3f7c04605bdc358388aef212f731
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.0MB
        • SHA256 8014372c60d36a48f2fce112dc7c6c2e9841da4ee9135a03f986b06005027a41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 27.2MB
        • SHA256 91cad106950852aa45686a9c8ab5140a6e3cff04f1a244a4d800b3a9f4380aa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.9MB
        • SHA256 841e893e6173afe9dac43d61a31e254cb331fb027fabaf8ae6095308c6ccb815
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.8MB
        • SHA256 eaf57e57968b111448ec9492f740cad060ca0fff67b33384eb8e9d4d0cd5fd07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.7MB
        • SHA256 75946837e144b41464d46650bf2dcef0ea8845bc2045d88a0073d916a57c46f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.6MB
        • SHA256 db9b8cbe60e58a68c0b7c706db85bbf66aeace2e19c239d58b1c2867e55e981f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 26.8MB
        • SHA256 4338495259e1849a10d0f3504995b615f3cb87e9a4e88f0d71f2352b01f16b27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 30.4MB
        • SHA256 2e10f0d7dddd2ff109b63b6211de83055684b2d1727022d2865ed80eee330461
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 30.4MB
        • SHA256 f5f04d61035b1ee3728475a8dfeeb06fbc1d28fbe3fe3afa6d5e062b0dc6ee18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 30.2MB
        • SHA256 f8f19cb0212b3848566e837a3c00f56dde2d2fb2ef961bdd56571d49414a83f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 30.2MB
        • SHA256 af61363ee57cf33412b421d69e1a1c8cc2d8d0afe0554fb9b62eb28b1c2354bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 30.1MB
        • SHA256 fa242869b0cc84f7bac2a99ebf25495786bc8f033e8fa1fa5ac313218fbf8bd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 128KB
        • SHA256 e52488a8a3c5c15a2f928eb2127c84d20ca0143b2598bd3c627a271a6a7a3d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 45.2MB
        • SHA256 7d52b4c6708a805bdef637101a52d25a934706af425cf15dea2445924e38012d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 44.9MB
        • SHA256 1bd622c711f6d14b93c5ba44ef0aa5398123702199abbc48fee53d4ef5d2633d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 45.2MB
        • SHA256 1f83c219930812aae165a7083f08bc6b4a08ef7a5528067967372ca1040ce58c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download