Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 13:11

General

  • Target
    2026-08-13_518e8b45ae2ccb2faeee0e44ca2485d9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 10.8MB
  • Sample260813-qe56hsbb68
  • SHA256 40005ff0e0c02eca81839831598e026bfaa43102d2f0cafb2511a6a72bb791d6
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_518e8b45ae2ccb2faeee0e44ca2485d9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_518e8b45ae2ccb2faeee0e44ca2485d9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3036
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_518e8b45ae2ccb2faeee0e44ca2485d9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_518e8b45ae2ccb2faeee0e44ca2485d9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2572

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe

        • Path C:\Program Files\7-Zip\7z.exe
        • Size 11.3MB
        • SHA256 eb89070aeb75e90451c07915528ef07c1b77fa71d9ac1fdd17958de5be3bf053
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zFM.exe

        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 11.7MB
        • SHA256 bfcdca62b3a3e15550e120ae7f543b1dd956bcc0ce4c0892481ddc677e6ea2b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 22.2MB
        • SHA256 55841501838aa2a3c70e9d15eaf0794acd33e38afde5292c41e5f10bcdb88850
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 21.6MB
        • SHA256 32c2d619cb5558f93ec34eb89681fe54efa473f5a2509fe14b568590351f6c2b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 21.8MB
        • SHA256 ed0d7403de26d30d3adb16d9a8f92f78dddcca7e3a2f90130452acf479afb711
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 21.6MB
        • SHA256 def8bbcd17dbe9d2d26c5fc33dc2254ed4e160bbb119211e29b06fe9c5f5011e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 25.7MB
        • SHA256 bbff8d96c036e0a1ce1b31ddd07b8c21d80e2118841c23b1013aa61b9ef39af6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 21.9MB
        • SHA256 43c9445e371655807f0191b4a660e358ba6b04e5a1efc4fd04310647bc92e121
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 45.0MB
        • SHA256 062dc40c13d6e2ef68a2ef678c97d4bb3e7d91873739aab792c5730af5a2cc41
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 23.7MB
        • SHA256 9928c82e5198e25d0fac6c3b61747c6ba944eb2c3f03350eb2ab5575a04377e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 21.7MB
        • SHA256 7bb61f5fe8f63452460b893025cf898adf9b63cde87b66ff913a02e4a7ed1ce3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 27.6MB
        • SHA256 0e8d11fb3697a7a6cf3539544624c4c3f5c99e4c19ca7808a6268266cc4fa4ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        setup.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 16.8MB
        • SHA256 f0a437dc6116f5f42d6e8fde82796f9219c763ece0badd9f2ce72ae1e9e84a42
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 23.3MB
        • SHA256 444898e3ffbd3d741eee6b337079e0d536a9214cb2f61e4750c3998294d4cea7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 25.0MB
        • SHA256 4b371e60884f4736e16083fbc914a049f4b1f1d0274f1b17d0f53d8f22f0e5f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 23.8MB
        • SHA256 80a8f174273e6ad80625d7f24e87210d4b21694d3aac5f73bbb7e0b8a638e2e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 12.4MB
        • SHA256 99eaee69fa518c45e0f5926cece7243f73b67e3580c155105a32300bead28acd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 23.4MB
        • SHA256 64a710c5476a025fc77fae5cbde6b2a286185b9916305ff1b28a45d7739b78b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 24.6MB
        • SHA256 1898fbb219d15dd7e5d141f118b76f58950668cb589a28f62b8d679b950ac036
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 23.0MB
        • SHA256 3ddde336c6cb7133f05f60a824bd4bc8ba88dca6c415cbc2d2ea813dca9e26b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 21.6MB
        • SHA256 dfb03e506e7e4113dc3ac44a40960ea0ce4c8076372ca08eea93fe50ab75d735
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 21.6MB
        • SHA256 aa2908b9a2053ceed269ca03276aa630e48662a9e49f88f0d8cab2c296982a14
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 21.6MB
        • SHA256 21a61f87eab65f2400a73931b8b83d6363f7070160cc5da54be43652d0e512e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 21.6MB
        • SHA256 a85a9ae8644590f56bae7e6def31015eadae6d8fa60b61c4bdb53b4563acb971
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 21.6MB
        • SHA256 269a1ebd7cedbf2a3cfcc2195d8d0f9f1a337ddeaf1b8734c33ea66d8d48dd24
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 21.6MB
        • SHA256 9089fcac2f22b6055f1c1edc7f0986d00e8e7088b2c4b75748be46d020b447e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 21.6MB
        • SHA256 79da7983f133ff0d7b34dbc06fdd4a84c660b0519f0256de37a7b36f964d5eec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 21.8MB
        • SHA256 fef7e326324dd1db4bb68cfc397a6477c367e2f2d9aec553e1245feb80510481
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 21.6MB
        • SHA256 8296baaa369d11de2da98c9a016241417bfbc1f893502ef36f2ce1308456d1ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 21.6MB
        • SHA256 c4e4232cd61b130f76c128d36e3d7dc8e28a5f85c0b2e2306b0958ae21525ad3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 21.7MB
        • SHA256 83738fe142a593375c4923b39d4da3d2e56f995a5c071040f76cf0b5da4fa65e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 21.6MB
        • SHA256 7ebc2f379625e3231a6792e4388b28330337f9eadc28f373848422a7fc5f9b88
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 21.6MB
        • SHA256 baa34bc15cbe189d021ba9723756c06202ea7872f79296419495c2babe519890
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 21.7MB
        • SHA256 7c6b43b6d45691d2d2829a5246ce701a933a4f51403538f14cf2a133535585f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 21.8MB
        • SHA256 b78bbcfbfbf7b48ab16fb0ca6535b0815cd9976ae59fbf767417313050dc6205
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 22.0MB
        • SHA256 202c7ce6edfa5bacb83f28349257066b15d56bae1e78b77d72f60cd39c18a4fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 21.6MB
        • SHA256 f77f252570d668a4e786daacb69b3c1bc74115a56447b29d795f4bc28a42d9bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 21.6MB
        • SHA256 9abf4f044031732eedbcdfdebd517ee5e546767caab45cedc544321d66d68338
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 21.6MB
        • SHA256 036b7eedc43b015fdd1defe2137de91518b8b9589b9e35f766d6530f6bf526fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 21.6MB
        • SHA256 31ecb44523c6a2e350c416ee09887b93070d60687bd5fdaef3d9a34b03fb8397
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 21.6MB
        • SHA256 ffc2655415f9f63b55403fbc429c97f7ec0f3742e6222924462a457064bd50fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 21.6MB
        • SHA256 e9188b0f2fda2a7d328d20486700ef1c614a3a46f59e84ae1049270185fd2b1f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 21.6MB
        • SHA256 93589c5b9cabb0a3effb99c999234a67913aff380a148a0b13dafcf36c0bbff9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 21.6MB
        • SHA256 dd08b80ee64461160c073f6a88a51c4ae0c5c2454eec83f08586c764e534a1ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 21.6MB
        • SHA256 65ee085fd6a8ce5d37755f75252d19c92f8c62a8d7121793b35827c564b16c18
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 21.6MB
        • SHA256 d69df88654e5c5be5c97014b40393e893db5703402b7376f5fdcd8654afd9625
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 21.6MB
        • SHA256 a818e2f9e52a094066684fd2b2ac3951a7b7f45357fd6797f92721cd2863dc74
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 21.6MB
        • SHA256 548eda54167809aef314afb37826537d7fcfa03de6cdd11a2f6a002338ba9c5b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 21.6MB
        • SHA256 8543de478e4631d1613c7ab05926619d62150e289b7109c40e8aa43152bf58f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 21.6MB
        • SHA256 7f050a8aed72c29bd7935dc7ddb64ade7078d1e201f9b4a4341d3d2a62636c9a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 10.8MB
        • SHA256 7a3e6362b28241fae475572732eb0b401662aea7d50794b1ba3b3803045d5607
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 21.6MB
        • SHA256 7eb01f2a924d6cbb36f91df54118091923790ed4a4948dd2831dddd0f7435a2a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 21.6MB
        • SHA256 0f03bee3c5243f1349dd6fa2e592b2e03100bc4801d77f4c1f4163347980d32e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 21.6MB
        • SHA256 b894f2403294d66af2fbaf3ea793fe1f8fe87db8ed57b1ef5dc1005031eab9af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 21.6MB
        • SHA256 1d2f0961865293fa45e9e664b74fc0b2c56ff567a7c82f27eeeb8a82c3f42354
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 21.6MB
        • SHA256 be8abc49f6846c6da3b15f819821f666d026a17fe6fc626b9b01674661a6d9e1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 21.6MB
        • SHA256 4d127ec05e516114da5f3e5cfa27c878c64cb0733f5cce43b554f52f344f2739
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 21.6MB
        • SHA256 609e87ea78954d33e362fb854987410cfccc1e2ff47d5cee7dde67c477c55d5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 21.6MB
        • SHA256 195c62d553ed4a701424d6a768d7de29c6e760abe1e144e698fa715db7889feb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 21.6MB
        • SHA256 6da8349f23373a9993fbede5b3b21a22482c0a71c7282af8c099e763737d86c1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 21.7MB
        • SHA256 ffcff4044332535d870f7ffee489a88924a7896a7066fc30e16cb13e0949505b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 21.6MB
        • SHA256 5662be88dd811d3f5804d169854a12f2958cf609eaad433c34ab73ff026a5ad3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 21.6MB
        • SHA256 ca1fc1d144bbfa97eb59b98a1f0bdee644cb8c52257b2024b50d7c1cb9da2b39
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 21.6MB
        • SHA256 306fe162d591f1097cae47dea722b1192c466c6946be40ea2965cbab177ec40a
        • MD5 SHA1 SHA512 SSDEEP TLSH