Overview

overview

8

Static

static

3

2026-08-13...wk.exe

windows10-2004-x64

8

2026-08-13...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    20s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 10:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_0697d221fef37e63e0e34fc699f15583_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 18.8MB
  • Sample260813-mvb1tsfp4w
  • SHA256 8984d4f518840fbdc90804c12dc24051c4c466959cd90fe3678dc68b1737a34f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_0697d221fef37e63e0e34fc699f15583_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_0697d221fef37e63e0e34fc699f15583_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4772
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_0697d221fef37e63e0e34fc699f15583_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_0697d221fef37e63e0e34fc699f15583_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:704

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 19.3MB
        • SHA256 04012887ccb1d20d0a07eda8d86e396cf5dc145a9ed2fb24202ee462f6fa86cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 18.8MB
        • SHA256 8984d4f518840fbdc90804c12dc24051c4c466959cd90fe3678dc68b1737a34f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 38.2MB
        • SHA256 de9bbc386366ffd97968a2289b7236ca819f9cc86093ecb8a10157c85303c425
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 37.6MB
        • SHA256 73ff255a96e1153b24e54d2c3621330019934c8a3c4ae498fb808f11dd02c822
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 37.8MB
        • SHA256 96fabe540684f8466e9175efc5f2b10864fb0e75fc6669dd8e1b0433b91741a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 37.6MB
        • SHA256 ceb2ca9eb6f736edeaf17dca5f0bc1047c30f31bc30bc5beb89c853e9250f2f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 37.8MB
        • SHA256 68f1610cd831b64797ccfaac68312f3585ae8a051684589dc95beb8b0ca82688
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 37.9MB
        • SHA256 4bd228118f4e6abf2f008e10fd09533507774c512b8425c2a1f509a973a44d49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 38.3MB
        • SHA256 772c29f6c9d28488773c34676e83b0ce682994de08ae36a1345951b5c3e26f0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 39.7MB
        • SHA256 5570c8b0ec1a0b7ea467e837f868b7c0627c1480f9db95af95de4619490d2df0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 33.7MB
        • SHA256 18daebb2c6982cbd804fb133b9b5810ddfbc75aa12c7fc7971b5437db2cc4893
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 38.4MB
        • SHA256 daff752ed52f765a7740d598b5e9900b12a0612638cfad40d8873ccfc5cf40a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 512KB
        • SHA256 fded04c6d782f8085d397cfe282605c1f1fba531c6920ee79072db343ae14316
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 13.8MB
        • SHA256 888f78d8eb55a1e0886cc2407c97f6400e69fe078825db55bdc534b3fa2f6c89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 35.8MB
        • SHA256 e2a61e24bd85b382fb7df5d173b014c9c95dff6acaa5eeac630605b20691ef8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 35.9MB
        • SHA256 bcc85ecd4e0b366652fee60c8e9a91fa2b733615039aa21fa855cdcb061afe14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 33.2MB
        • SHA256 cfb98efdc8e5d4b0e356c093ad0ac2937ace7bb22c97986db9c9bee653f218a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 33.9MB
        • SHA256 f9cbe1d5b3e7d629709d048cc0f9d947bd0a579296f986d05e2b3710ffb24cf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 36.4MB
        • SHA256 4971a25e6afda797968a947930714a7634e8fd7bddfd7dda854262e695bc83b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 32.6MB
        • SHA256 ab3b2be4003c09cf7f4bdae57ce34179c207c895a52b664caa32f10c3fabd9b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 33.0MB
        • SHA256 937df2eb08f723317ffc05eca3640b64871144761fd8fc0d8b25fb998247e001
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 36.8MB
        • SHA256 da6e70cf5f3cd186ee5cad08933814c67e444a1488c9388bb9b0673c97768158
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 32.9MB
        • SHA256 504801b38968a7260c1dd4701a36d7bffcde0baf47a69855e2c61d95ba122b10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 36.2MB
        • SHA256 9a922bd8476d62e41bad3cdc164805e93f061910a6ff6232bf777301a76310b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 36.0MB
        • SHA256 732a0ebe58d79e389775fb24191cd7f4a0e5e903f915a17c58b064acdc402aca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 32.6MB
        • SHA256 59b71f4dd4165f87cf300248f1b5f74fc8a3dde3f42668dc7005b106b6bb69e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 35.4MB
        • SHA256 9dd02458526ae1f399ac5e240f88100d9dfd1c1f049867e08a9ad2968574ea68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 35.7MB
        • SHA256 a7ed312f823e15426fb9c7dd9926f38831e0b1f98d79e9485a293cf3ee7c577c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 35.6MB
        • SHA256 a092d26acba7280b8daccdb211af995f46ab3eff389de0f8a2c2d56fb8f375c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 36.1MB
        • SHA256 2f053dccb4e516c4b6ed90d98b9d3554e3c0395e53bbb93e7986e3ff6b675a2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.6MB
        • SHA256 568ae6741a395c317c14fc493ce15201bedf3530a9033b69e2f4f760fd814021
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 28.1MB
        • SHA256 6480b46214fc75a9d64d352aca91e6882f8cd74fb394db18d7256ab88a4f1462
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 35.6MB
        • SHA256 8ea35d636d24d380f4b2cfe7cc4057af19f6960852dad66a237b62e5a182fd58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 35.2MB
        • SHA256 800db7c666fac72b7cec039714999ef57db34df37aeb93aec8a1c4eb00ee6465
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.3MB
        • SHA256 d7476ef3101d207366613d828bf375fcb643ec3a7551ccb8082e500d86899dbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 31.9MB
        • SHA256 6bbbad39bc1c83b110c6e9d1cac3626225ee2735c8286f7d2710fe0281fdac33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 35.2MB
        • SHA256 7bb9a891ea82343d68ce4f565f4d27418bb59b30c396259542739457e4d70175
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 31.2MB
        • SHA256 a37b350a2991db29ec2660c6aa001d3f08c10733c09280d43700753b52d4aa84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 34.2MB
        • SHA256 84105d7eb94137bd4a19f50346ebd97663cfb58f2c0a70bb8d0bf1a8c36e4d88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 34.4MB
        • SHA256 3ed554b24643ec6aa62715b2552b40f8cfadaf14e95ca04f3b28e74ddc8e5ed6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.1MB
        • SHA256 fec829ba2cc99add8f0bc4adabd00e9e315376e380278e8971df1ba40e13e6d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.6MB
        • SHA256 e37f08abdb0c7c2b66a6455fa605dcd4832503cce927ad2a00621eaf8291be9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 34.1MB
        • SHA256 8efba223d4d11616d1059244d36a07f3ce63f87a05ae78e5bddd2214da0d4c3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 33.8MB
        • SHA256 423cc97788149fb140cd8b0eecdcb9fcce9842efb72687c0d326e7594a2576f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 33.4MB
        • SHA256 25692186f73d5bbeb548fc0f0b55e780e8b2caa6c9ff1f11ad4fa31e94c75d12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 33.9MB
        • SHA256 4c685889b2aeaf70e164ef10c758bd0afcb0f64277db943250b8c4b8bd110bbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.8MB
        • SHA256 15ca60453ff8e4cba475d09c13ae2a9c064bc9afaab57b3107af853b0e2f87dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 32.1MB
        • SHA256 8b4d1ee0aea062a990ddea70845be4b6a0b727b8b69b9c304fce35dd2fd46c25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 37.3MB
        • SHA256 613b468b8fbb2e9ed44cf5d63f73e8d5ec1e8185631f97d76a37d1066c880f94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 32.8MB
        • SHA256 230532ff3e54e31d1b1fa85b04e4a911be9fff8c995dedda4ef2bd60d31b9917
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 37.4MB
        • SHA256 76effb1e6bea643ffb92292b6bb6ba575a88015031b438b4dd2d2d1452f7e618
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 34.8MB
        • SHA256 eaef85a0953df9191a7c7141b717637226ad87b6876183ad59059a9e22829dc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download