Overview

overview

8

Static

static

3

2026-08-10...wk.exe

windows10-2004-x64

8

2026-08-10...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    23s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 22:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_82dd8be55c346c48dba4163fac64218c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 26.2MB
  • Sample260810-15xbeazdpf
  • SHA256 801ce4e8d6fee72a3dc5dbb8d2ee3b8bd18c3a35726fc72373fe31098299c498
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_82dd8be55c346c48dba4163fac64218c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_82dd8be55c346c48dba4163fac64218c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4772
  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_82dd8be55c346c48dba4163fac64218c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-10_82dd8be55c346c48dba4163fac64218c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3564

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 26.2MB
        • SHA256 801ce4e8d6fee72a3dc5dbb8d2ee3b8bd18c3a35726fc72373fe31098299c498
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 30.3MB
        • SHA256 610f04b4dc956d83b57c4f3765f88b8f7f68963154319e5702ef022a9465ebe7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 52.7MB
        • SHA256 7dc9bf3673c8c35dafc45ad65d65b50efe1ae2a8c96c6b211e86d5d1009a04e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 66.2MB
        • SHA256 ebd735ac82fe574be8cf12eedb38323292e57f45bfd0bcabfe9fadee6eeb1a20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 28.3MB
        • SHA256 0c3238c740c730068d971759b503c76548fdf72273c4cad5bc92516efd40829f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 52.4MB
        • SHA256 ecf02f31549e2a159fe0521cdfeaabccb4a2996c158b27fe6ad43ba0cb7dfd5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 56.8MB
        • SHA256 3faff012cca96be5beb3767cc79ddd48206d0b6cee7c045d3513663188ec909c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 53.1MB
        • SHA256 f38457fd2afe74707ab1404fe19147ab153c77332d1602fa8ec0dac046403349
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 54.0MB
        • SHA256 3b4e6be26a3ebcdb73fb7843326dd8624c0ca7a3a8820dc463304739a0bd7b06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 54.4MB
        • SHA256 1c198063b8103a3c35ff7f6b2b1c8fb8a2d9963464dc1b37574cae265be04b7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 54.6MB
        • SHA256 390da93021b6b65149efac167b9cb64543dfba754ee71922db0528eca49ad9bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 51.3MB
        • SHA256 c401212dec14789a02c1602992e0d67b6027aed02dadcdbca5e2ec3f78d63a7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 49.9MB
        • SHA256 309f55d98e01529004804aa279aa60e8f68b2174e98771e4666239269c90990a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 43.7MB
        • SHA256 31a0419235a128fb46495facaadba50298405fe47120049ad5a2c0c68f753f1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 46.9MB
        • SHA256 54d2becfd0429ce17134085f6239d5c5162dce59dbbdffb21fdc426763bfdbc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 43.0MB
        • SHA256 27de07ca5880c3491bceed16a68fbf03ff5a83ea459a33b345c72bfba29a325a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 42.0MB
        • SHA256 34efe0e099f4b085517d40469612c62e29dc677847e19070b61c6b5662a6caa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 41.7MB
        • SHA256 5b2d99ad3d3236360030a52784b14b47060dc1e2b073f41cc20d00f00a634e73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 41.6MB
        • SHA256 bd3565dbaffd8e4b71ef5582966d7096ace117598f852dc97dc1521bc629dc67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 41.2MB
        • SHA256 13510eb9c341dd78eda2fca676c47431836d9d11a8c442eb5aa4d1b772359cb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 41.0MB
        • SHA256 731c599498ed43ba0b31509b7731dfa68879385965b0eadd90d7ba3945189e0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 40.8MB
        • SHA256 0c1868cf90e2ffb0288a2da734ec0187f2e5a31527e4b56221e7db46d6d79ab8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 40.6MB
        • SHA256 3a6a112c14179006da1c1206f42702591a7c82c30a006d6863377922632ed5ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 40.6MB
        • SHA256 40b4d55e9782d4306de49c1e42d5fa80215f760ace31af6d8925bfd28c22bfee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 40.5MB
        • SHA256 6c33e8c5bbd504f0773aabd580e1dac2e6f2037a6112ef1374e249dcefbc49e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 40.4MB
        • SHA256 b89fc9b012c393efd972673c2b2eb0e3e54d496af8236d70cfafb3f317dd13c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 36.4MB
        • SHA256 560e04acd5adce00ffa5c1184598671ee79231058c4d8e558842c1b8fe4adc9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 39.2MB
        • SHA256 37b8f2a1c8c9eb7a1b0aec9ebdc43584e8f66dfbe1f3a6cea7dbd2ff5b64007a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 39.0MB
        • SHA256 3915a9f576cc61304a88f2ba0792dfe2253be5c7b47545c47136d4821e92078a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 38.9MB
        • SHA256 804d42ac2eaf77e53a81a675978fafedc289bb2b8c08da010818facadad1009e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 38.8MB
        • SHA256 cc550b533ef3e8d847031c4d48d77f211a00bd4a46a08cad7d1f3166802a0086
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 38.6MB
        • SHA256 64236fa853c458d0c957b57bb4e91f1c13e49b1be7424b6af2a6839b9efa1de3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 38.5MB
        • SHA256 8723c93fbed43b6236b21f65b844f928e110bb9a3f1c073a36d7eb1bc6a7fefa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 34.4MB
        • SHA256 f12b2599d9f9c7ebf2cbc0e96d4450cbfbc99e910b6e779bbc2b5293dc8b271c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 34.4MB
        • SHA256 a2ee540b58e023a5a5fc032177d6418e01f8f3cdb846b4f52c3b084df3415448
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 38.3MB
        • SHA256 674b5762be86301958880b8f268ccdd8f85a0d92d87b3f0cf54a6dbd87a407ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 38.1MB
        • SHA256 63db755c2a80108d7b8b0e6d9c6b4e98bf65d1532d9239973a18e85961813fcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 37.9MB
        • SHA256 f45af1dd7bde8dda56ea5e424e433fc34789b59f5ed7de35e35c65e38b63cc1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 33.9MB
        • SHA256 14a94edd2d96b4cf76e1126908038953d093a575b61cf48f317a85d14ea7a18a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 37.8MB
        • SHA256 ce3c73b6ce1a1738a1a72abb00f7cff0eebf7c04b8817f2a4bdcdb8fc8756f79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 37.7MB
        • SHA256 0daaeb0f14c1dd84499fd6675cf94b806f8876bd70900002117631ce0ef5bcdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 37.6MB
        • SHA256 2c7c8a3f68e6cda2818270e2e94acf81d89511ca7dfe2bb2eb6990640641ddc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 37.2MB
        • SHA256 aba41faf3ced298be1c5c09352adfebb583f2ced74617846cffae9a98e22f913
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 33.1MB
        • SHA256 da5684a14ff100467f4a85436c164e1a16645e58ca5d9aae17071b428f2c355f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 36.9MB
        • SHA256 12aa954a4496e90eb08bba42aec7c5615d7ac83824c13f6ce484d49bd02fd750
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 36.6MB
        • SHA256 183aa027df8a2db9004e8103bd4860ba829203a1b0b2153717e2c4867cd13fbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 36.4MB
        • SHA256 17a71d167ebdbbce3be6772fcdd524817666a33d5b2b51aeb9f2e4b4f66f81c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 36.3MB
        • SHA256 e477dfb71447ea2c0142ce35ca13f9c571755b24a458456e4b4581feba68fa1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 52.5MB
        • SHA256 745a1f95b895092a6b3298794f4ebe7b613dda40a19daa1045c974eada3f37bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 52.4MB
        • SHA256 53d871bcb2c3d3d0ed4312298152f155ac660b7d477386eec1ef29baab23beb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 52.4MB
        • SHA256 e55142524dd89104751b714147a446bd4689102a083aeb287d5e9bde85901729
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 52.4MB
        • SHA256 532758dce2c6a77b187912902ccdcc7f10eb848b74eb60d66f34124c3bd1679a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download