Overview

overview

8

Static

static

3

2026-08-13...wk.exe

windows10-2004-x64

8

2026-08-13...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    29s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 03:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_d184a58fc765ab186ea23ed3c0505ff9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 26.9MB
  • Sample260813-dvk43a1aqa
  • SHA256 2b5f3872b5b26b70a6662d971b90d9ae5e74f9043643ead81b98f5debf74c37c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_d184a58fc765ab186ea23ed3c0505ff9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_d184a58fc765ab186ea23ed3c0505ff9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5660
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_d184a58fc765ab186ea23ed3c0505ff9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_d184a58fc765ab186ea23ed3c0505ff9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3508

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 27.2MB
        • SHA256 25372e417736747dc90137d9dcc55f48b134adadcac9edf6a45a31fa0382d4fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 53.9MB
        • SHA256 df59ac42d9fd0103976c03623cadd541cdacf11bacb7e1d9c7ca3b092e6cb0ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 58.0MB
        • SHA256 8df211ea160f0671ab48d818bde9e02d071c159a70ebc62aa704f5cb59ef3e55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 54.2MB
        • SHA256 ba210987dc6f4a318e64d2ee11e81f9dd3b668f5a8035b6646afccd5a5fb3f6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 29.1MB
        • SHA256 fe5c2b398a0e5282cbc99d48e1402f07d08a4a44bee6e64a88746e689cbde962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 51.0MB
        • SHA256 e3eb57d91772aa2949f0b7c41c6a66723393c50fcb1ae7e69753d1dbd3a20a0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 45.1MB
        • SHA256 a6716d4f8819467d2b54fe3910fb7a9be2e51d334a1ab789c10a9bc75a8416bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 44.9MB
        • SHA256 31ed131803bcbda08ca1fac691afa4f6fa37c99f8ecad6ab9a59ef0a71423125
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 45.7MB
        • SHA256 e9203ffb744a049145795fe26cd73b5b24fc791afc09d0b8a76a8b68d2e482bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 42.6MB
        • SHA256 ce98561ade82ea1fe0061ed997ece9ea864e5256ae40d273c5c4eae6e20aee58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 44.5MB
        • SHA256 d48edb52618bc02c83c2709c3227773aa0525e2164d7ed9c19473df52cf73a60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 41.5MB
        • SHA256 62682170b4357743ca0232d374515a3058a2133538e87afdd5c0fa32ce676dbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 43.6MB
        • SHA256 e86082227c3ea6b5df5d84710559831dae141f7e33de8ddf4957c897c54dde47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 40.6MB
        • SHA256 915afeb49f492578569455c18543996b8e23f203fcee190c1e85fcc82cb5b411
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 40.8MB
        • SHA256 abfd53277935da000708f65b51bdda1d458e640ff7dd663a1a75f1394f58089a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 41.8MB
        • SHA256 a6441cca83bc0abde57b38e6fcdc3b38e1f56c2c08216e8fb4c736b0be667a96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 39.8MB
        • SHA256 df688d574db5dd57a692d23dbf7f996ab179187f6513aad1ff05ff3f6f5bcd4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 40.1MB
        • SHA256 81801337c663a461be86c70bef01218eb8abf5b90ab5972ef2cf7fc69c2f403f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 38.6MB
        • SHA256 8201cbc0f0074170724443834d48c89f97042bd2d81bba243a874affa8fb5e2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 39.6MB
        • SHA256 cf1651b78c522f26039e5cfbcf0c8536fca4b7586c4eebd8db21a74ea6615650
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 39.1MB
        • SHA256 6b125a60918baa5aa7a65e5a246c1da219660e702faa552913bdab6b7b7285eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 32.0MB
        • SHA256 fd5a58f157a307d7f46143159f788b590210272eb00c1f30a1f8f08c2ef30ffa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 38.5MB
        • SHA256 eb6d4e53b02ed3b82129b0f8c39402fa55dd0bb491c2d1a2265f9ef20319fae9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 38.4MB
        • SHA256 4e513957cd9dec85850fcc9e592110bd7e9657dcf0c03cc9638058eb9ee42136
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 34.6MB
        • SHA256 860077049f3cd78508cd96a8fa3cd55e3c1798369f200937fa03fe62c1a274ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 34.2MB
        • SHA256 9b45bdb38e41ce1d0efe0281fa9593fe30a84a5f19b9f6efc85e9f639459f3de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 38.1MB
        • SHA256 2e9f543737d81a7127bec35457fc40584f067327080383786880d64133d60a4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 37.9MB
        • SHA256 5c2cd2f2c2b15c1615c4cb5a812c08c08c2731722f7a4ae3de164f64e947694c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 37.8MB
        • SHA256 de17f4d71981ff32720c39e076615b6222c66473277e5670e5463595c81ac952
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 37.8MB
        • SHA256 680cd31e9ca850547a2e9e09a10eb7446dd33d2eb2074f86b767ed9a94bb9949
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 34.4MB
        • SHA256 a06f94ea1b02329972b389606f9aed7873af7ab40218cff640490ef319953be9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 37.6MB
        • SHA256 c1892a7cbaab99a9b5f26781514ec3028d4bbbc833af3bbcacb2e0d1eafda195
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 37.5MB
        • SHA256 e07dca24da28efe078b635f3b2039768f88de0d5f2f0e322bb7d8bc6aae81367
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 37.4MB
        • SHA256 c057508f4d478498dc25ccad69f3b1e24691588f2e1a838773df883d6b8f0c21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 37.4MB
        • SHA256 6e78e992112f11e1b28daa79ecbf563ad9b476ad94b3f43f81347050c74a2a79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 37.2MB
        • SHA256 76f7728c5edf53c32c072a8ec7c48d33ef84c2faf9c203d56bc4fe78e07fd669
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 36.9MB
        • SHA256 046bc6bf38f388b72ddc98a959916df7b27696fa54d73bfce8e18d6e3ad19b48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 33.1MB
        • SHA256 3edc7c1e957990816a11bd910809ce24d4657c07fbf719c4c9ca229999bcf0ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 36.6MB
        • SHA256 5ee08c68f533adaf51e16807d44495243a4bcc54e2d1e5f9eaa739ed03559489
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 36.5MB
        • SHA256 ac9939ee1180cc5f9fc5a8a07025aa2789c191b78f5d45cbcdcdd767f3c3fac2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 33.0MB
        • SHA256 39afb82304abe994605cf09f0af01e18cc97da5aec568c4515b2719257e21334
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 36.7MB
        • SHA256 29a257b969436adfa794d3ae3470378907f215c715455a8f21cfdf8e8ea58f96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 36.1MB
        • SHA256 9c91dbb6c0e3cb9ee7e4e660b86c6e9214d667e3952ae505ad4a1b640ca06c98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 35.9MB
        • SHA256 b08df11918a8b1be8c679a3dbb3de48e1624da9933f0e779134d03a6ce970efa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 47.2MB
        • SHA256 1d0cadce0d2084e0d77165ec7891eb01ed4fd7376b46ceddab42a57bf18e63d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 47.5MB
        • SHA256 85ece40c59080703675e7846001c9262640a6268a70652350c5c1c6a44c670a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 47.7MB
        • SHA256 2a4cf37fc7436dcfdd5c732922efd85006e84cc1d685ea391d03fae92fc8e50e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 42.9MB
        • SHA256 80d998562da080c5f8d79d036df152a667bb98cbadd75fd039b551d2ea1137ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download