Overview

overview

8

Static

static

3

2026-08-08...wk.exe

windows10-2004-x64

8

2026-08-08...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    20s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 17:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_f5e59abcc82d7b336160a7e3e9cea67c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 18.6MB
  • Sample260808-vkggkaee47
  • SHA256 4a842132c3ddc3b31fa55deaadd0c46d4456986a25e81961efdaf53f47707b71
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_f5e59abcc82d7b336160a7e3e9cea67c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_f5e59abcc82d7b336160a7e3e9cea67c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4428
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_f5e59abcc82d7b336160a7e3e9cea67c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_f5e59abcc82d7b336160a7e3e9cea67c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3600

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 18.9MB
        • SHA256 bcecb0b6941ed31f2469c703ed0490698b81db34c02b959f8f86fef7da85cc49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 29.4MB
        • SHA256 ba42737c442dcfc359d56dfe527082ee606f4337328bf6bf7971f44a1a6ebb9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 41.4MB
        • SHA256 89a0e3dad549bf282f519b6efc53f657f872626fb454f09d4396f377d6f102cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 37.6MB
        • SHA256 224c156e0d528ea8752b42b3660c6336f587b2a0fca466fb83eb89d25c86ad60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 45.3MB
        • SHA256 25855ed90b29e26ff5ca0567a3ea0a87ca84ad45a8cbeba2a6b5620c10d9e2bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 20.8MB
        • SHA256 9ed9ed5864493f3acef6a8eabd996569b9edbbccd804207d551b609ef7f1f1ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 37.4MB
        • SHA256 fa69507a74f60d50cba2213b008f8e0414e690ef5d76067ceafa89dff0c478d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 39.7MB
        • SHA256 efbab13d395276a7204338053d7ab44ef98153f0004f763ea3d73ed46823ada4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 38.5MB
        • SHA256 e157cce99828ac9edfe2af4f872502c02209b6d71643f9c7774205a216531b30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 37.4MB
        • SHA256 ff2a5a825e7ab50e17e7a9002fd71834ea1e50070d95561a9f3e4c6124b1d5d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 40.6MB
        • SHA256 3bd843364ee2375b79b1628aed0e9999c7e0c7fdaf1d1667e9471ea25443a4b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 39.4MB
        • SHA256 5707f8c682546d3babc40729fc10ea696f024d3287eb9759335295520502f640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 35.6MB
        • SHA256 9fbd4d88cefeb2f05941dd9abbb77c7dc5f2bada82fd9a936196abccb47f0c7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 32.0MB
        • SHA256 3bbf06d77c29a160392dc3245e7265f4644899a42f34adf936c0e9839dab3e2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 35.4MB
        • SHA256 89e9baba3583a3954516c1a0aea557194be02cd0cee49ac9bed7432085f5ee53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 35.2MB
        • SHA256 c52849cca580da3db3d47cd6cd84094004a8ddce33218e5b86fd2360b362cbfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 34.8MB
        • SHA256 016fec85a4dc2ad2e86e92f9135cd3ba81048d6cef205a50eec5dd1080f45ccd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 34.6MB
        • SHA256 058cdc19f51dea4f81cc83094b432894a499ef785ab008e126169088b1651081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 34.4MB
        • SHA256 e271c7f063c1c85fa5ccbe455d56e1991da5730d9640d1ce5e986a4884b8e10a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 33.6MB
        • SHA256 657615bb56d00381194845d9fb55e35415c9d9b1bfb11a5b7b84fb52ff086813
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.2MB
        • SHA256 79f1b81eda7dab4679ceb0328aec50fb35a8f5e7edf40ce43e1ba6d00076caed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 32.9MB
        • SHA256 ce83c19f4673878189d3eb3b1e32e50e3762de2229e07aabf3a3d5a8b060a36b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 28.3MB
        • SHA256 d24edeaeea2ace3583ede189156b0bd4d72a38c9f52293582d43502bd6e31f5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 31.6MB
        • SHA256 95a2eeb81dc89ad688d15a91b4c8679c00c36190254f2d7734f8e27cf213588e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 27.4MB
        • SHA256 d5fc6a72983d77f08c8d239bb041026b0d7332c84808294873bd215f01a4523b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 27.2MB
        • SHA256 93bcab87c43fcf656f4dc3316cd727fa12615085609b1974a3a4f301a7f2a121
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.0MB
        • SHA256 1d55f4bd96514b21f4a4c11aa23ab4fdbf5289e3a2365dfbec750e1f00887160
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 29.7MB
        • SHA256 4c5e3365c29ec3ddece1d592df26bbf1ee0c9bda256bc22edcb8042a4e917186
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 25.8MB
        • SHA256 d6063fac62827a96b3d32a97722b407a8210add20f431b6a7102d1bf0a16fbc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 28.9MB
        • SHA256 7023ff08d2b7ea4088f45b9365631cae51bea2c074353818341f9eff4eca27e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 29.2MB
        • SHA256 98dcdf3fabc3151dc1ce6f30b1ad6ca7dcc1a0791fc710dacf92605d0a1e7975
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.2MB
        • SHA256 935db486ea95c0a2335c6b73c1d39bab1d53417275341a676e29e0dd820a1fbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 29.1MB
        • SHA256 5c2730b598d94ec9140f4b4ba622a119db6e7568e540fb5526e63bcb405368e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.0MB
        • SHA256 a3570e4d19f323f8653fca5ffc31bccd3582af141504678c4bf407be9d7828ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 29.1MB
        • SHA256 b62a9282ad42be53ce2c4d185bc294d1b7fa0cb3c4c13aea946e8d01e18eb9fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 25.3MB
        • SHA256 109f0ded6fe4fe15d0248bf4f309c5ce79c599200e6c0d9db655d0ecb64fb2ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 25.1MB
        • SHA256 6fd36e19d20f929858e26964781d85063cae09ff2e1a01e55b2e0e02278587fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 25.0MB
        • SHA256 d94a8d5db70ebe7d6532dc3ed4ebef49390bb5caa570745f880e7d17cac74dd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 28.8MB
        • SHA256 359c8f61db78ce35bc15c4228e631245d924d14fd19391f042d17c0de279030c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 28.6MB
        • SHA256 1ebb82ae3881dce0eededa6697717c99a5f19758cb48b368a7b4e83284c8323d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 28.6MB
        • SHA256 0711e3a05cb1e99404d8c99a5291af9bc30f552db2d156f6a7e80047f0f7b6fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 24.8MB
        • SHA256 9b420c2d695ce7e45ad26aab2e58f16779f3655d58ee14486976c9950ebced1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 28.5MB
        • SHA256 0664fa502e34c40a87050c51239b26326e1f0cf15d0e1d67824e8a84bbe90976
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 28.1MB
        • SHA256 35920a86af83837db2c60666df50b5d603ef075209eccffbdad368b197801664
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.3MB
        • SHA256 5e283693beff1df0e6e269ef90969ad6dee7797ec18128430d17ed493438ef52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 28.2MB
        • SHA256 bffa115b8a9bb61af19af7799c0583e821ec34211b7c5394a4f67eaa116cc766
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 24.3MB
        • SHA256 7c4b657a0fd3c1dbdd1c2357297a3ce140ca69f8e7ff41c0b31f233b3a59e22e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 24.2MB
        • SHA256 004ca260559f6c9f9f87a51144e07f31883c590fb19b048563e2b54a7c962325
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 27.9MB
        • SHA256 bad2399101891d2908d346775f5c297b3348c6f486e3deed0b7ed536baa06ba8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 27.8MB
        • SHA256 adb458fd954079fd8f9bd99e9c0aa39cb55de21077047aec0c2b1cb135acb113
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 24.1MB
        • SHA256 2a5401dd74591807e1407106898baa495fd39f6fffc36e9f9cb6d8c893fb5179
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 27.6MB
        • SHA256 d740d2b01d33edfa945446777fd4c35ea99e6f2f2b66954a75dcb9794b8fee0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 27.5MB
        • SHA256 0405d4e3cfa9c6efb95a880710071fcbcee269c33643e827db6a9cc537fb630e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 37.4MB
        • SHA256 5abf5ac986fc54f368e605393c0d4f0f7f2388f9de8a3c0fdbbf79d6ad9c36e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 37.3MB
        • SHA256 ba6d541d18afb26e2ea98b03b0d272efa6d8b9f1600256bb800cd52aecf265f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 37.3MB
        • SHA256 524c4f65905385e6383c7b8245992a85cbd3685953e50d91aac1abdb94d539a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 37.3MB
        • SHA256 531731dfb8bed49b6e5b25c1c21764ddafa28cba4282141b563aabd1809b30a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3600-17-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4428-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4428-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download