Overview

overview

8

Static

static

3

2026-08-08...wk.exe

windows10-2004-x64

8

2026-08-08...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    139s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 17:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_d283057d502a3d4d80eb0ffea2368fee_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 38.9MB
  • Sample260808-vrt18san8s
  • SHA256 c569315dc94630e44f3abbca48eebb621cfcd141087a2e4d72d90967464d4391
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_d283057d502a3d4d80eb0ffea2368fee_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_d283057d502a3d4d80eb0ffea2368fee_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4944
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_d283057d502a3d4d80eb0ffea2368fee_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_d283057d502a3d4d80eb0ffea2368fee_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3560

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 39.6MB
        • SHA256 826ce05b8e07499729b9cef69341acf74be24ec78d2668be3b51cc613850da4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 39.0MB
        • SHA256 a9681116f987b339f9b435e2aa8141cb5aee5bad3df74c8c6e06e353fd77a771
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 62.4MB
        • SHA256 4e1c8459386a1c10c442c3e1af6df1acc469bc90084b23996643655c4a45bb8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 41.1MB
        • SHA256 86bc7807ea643d8d03f38d83c90709997fe448daca1f9fb4cba7a919124806b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 83.9MB
        • SHA256 9041cde7ac4a94875819bb12c3665160b96984d89bf9f8ed530ad7ecfffa5eb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 79.6MB
        • SHA256 b1066af2d8da5921a041836a62e63dae59d0bd015ffdc9337a9feb5d534c9093
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 81.3MB
        • SHA256 578120569a13482feabee28d1775c3a419558ec3f9652ff2b2b24b4b8482cb97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 80.2MB
        • SHA256 d8428e79013bbe0929367750fb24bc14d5c2efa3e227189af9a32054ed0d7d9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 79.5MB
        • SHA256 c5991b989e44f5e1eb8ef2738c65320164ddd767b7fa530a5dd7c5662be5d567
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 79.7MB
        • SHA256 7cba48dea907776c98fec5ca5b18f05fcf15ed8f8f62888decc8cf3128a78446
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 81.0MB
        • SHA256 fdb129076ffc5a11cda1902a036491dbc480f8408c6161af39d2207ffafcd5b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 79.3MB
        • SHA256 3e8269765badbfc2ad007f90cbb3fec7b56fcf469c8723e3a12222ad6e07f4e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 65.5MB
        • SHA256 111d8e9f03e068faac54e0013d76899d34bea0efb8343f31013b739066469532
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 52.1MB
        • SHA256 5458731c318ac43883ea38f62a3ce42fff758ab2af364f6d77da9e7ab2c0b1b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 59.3MB
        • SHA256 216b5b3c362631e703d779deff5d55b0d49aeec6b1c3333ef71506e271c9c2fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 50.3MB
        • SHA256 234688cdcb4f9cd5f89abe972963fc98958c6ca00f929f03da742ab420342bee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 57.4MB
        • SHA256 4f238106e4879cd238ef968c80fceccbe8508189c0514f31d6569cabe28d45c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 47.6MB
        • SHA256 45cbc078d0d11c4f2cf0cfd2547231620095eed813e9d849f85e1e1fcf3367bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 46.2MB
        • SHA256 72f5bb7481fdbf4d5f2024b258ecc8e820c8c2d81c7ad80f40a4d248f9dc08dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 45.1MB
        • SHA256 2741cf0a550d9ef6193358590414c491e492e24fab13571ff06cb8245fd33e9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 44.8MB
        • SHA256 cd604fb992f191884493b6b376fcdf9b5fe86adccafd970504d39b815bf671ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 43.6MB
        • SHA256 870aca4150efcdefb19b6b05638fbaae71cf9155130f83c029e0db1341be75a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 42.8MB
        • SHA256 ebd7fc1db3f5e648cb09c57955accb78dba28c3f8c62b0c4c0e992759ac8e3fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 77.9MB
        • SHA256 bbb6bbe705048253a0a37ef15d7ce5451064b9c2d78004548e12f487e5fca7de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 78.0MB
        • SHA256 24e3fa309fee3b4b219287f61d221d6bd7bc984e04e272ce53df6109212e3520
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 77.9MB
        • SHA256 95cf469f7c924f25fabc2530ab86f597f1d0ff0534876305dc0a10d02efcc994
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 38.9MB
        • SHA256 c569315dc94630e44f3abbca48eebb621cfcd141087a2e4d72d90967464d4391
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download