Overview

overview

8

Static

static

3

2026-08-16...wk.exe

windows10-2004-x64

8

2026-08-16...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    63s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 10:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_a6fdc24bf4c0442de641b94a8131ddcb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 34.1MB
  • Sample260816-mac3dscf58
  • SHA256 1a32fe5ec0f0e73efa3b2417da17f8d91ea44faf45235a0b4108fc2a7315298b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_a6fdc24bf4c0442de641b94a8131ddcb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_a6fdc24bf4c0442de641b94a8131ddcb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1676
  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_a6fdc24bf4c0442de641b94a8131ddcb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-16_a6fdc24bf4c0442de641b94a8131ddcb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5364

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 34.4MB
        • SHA256 6ffd6345632328ae94652f335b2061be76bc122ed54c9f6dcc70a91f5ae77dff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 34.1MB
        • SHA256 e359c7871988002b5531848b848e1f18329eb5f4f04c46bdcf49a785c4f8f421
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 72.3MB
        • SHA256 cd15c4357aa4a02ed725ed6c2af318f789b019e580eca6ae1ce5029dc53f5bea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 36.2MB
        • SHA256 8042a834d10ca46e1c603346d86724211a7412ccc86ecbd45e5fa9d62a64b599
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 68.3MB
        • SHA256 8efcc117c5a7853f976bdc585e1cac9d4b9d48d574e364df6917c4bd2e4ea523
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 74.3MB
        • SHA256 26f1f58a224d7d2e78c8ef53ff9c09678d80901711313d2a04ae5a20472cd671
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 69.9MB
        • SHA256 54134367a83787deb66c25afaafd984bf3c2a3e7b8f7b320fad0c0b889134cdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 71.7MB
        • SHA256 8d8ce736e572737c7285ef3110eeb84c8e312589e440afa1310745f677f24c8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 70.5MB
        • SHA256 98053a523aba44d3963722ea618fcaca78d306f80a47be1ed9977ff7c3882179
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 69.8MB
        • SHA256 761d220762512910ef3176f930085fa18e03bac2652de9957767d64b07089006
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 70.1MB
        • SHA256 775ee1aac7c2d812513778a77ccb62196979bb4c9822f72f2ea55fbdd5acd8f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 71.3MB
        • SHA256 fc031c1a8ac8c06a126783027dfe5d690b49cb540887b2501229b4b02b95c8ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 69.6MB
        • SHA256 4af034a3368e5a41a9d18cd666411025b5015807a0258d43d658e995004cf612
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 68.2MB
        • SHA256 f8d54669398cfa7868819e667231054c4d81080caeac8f76611c58a6e80660bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 68.2MB
        • SHA256 e7881ed1d64162bceec635233553e2c51716d3bf2f98762d19cd085f4abbcf25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 68.2MB
        • SHA256 aacaa4b3244d722d9ecf0295ebb750cd31dd1dd43fe49b7d590088ac2d4d9473
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 68.2MB
        • SHA256 8c7db14e22bd7c89dfa1b6e6e914d169ee8b6aac72a6a33320ae60c2541f2356
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 68.5MB
        • SHA256 d1d2b404d43ee104d89ada37de3784b713d12d59fbe7440a3d770dbf60f2f36b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 68.2MB
        • SHA256 aa2f2ec275b1393d8f40e0c2ecd1c89b1fb664584a1b0f3ec484ae25595d7720
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 68.2MB
        • SHA256 9a291a233a25a1e69143e89b9ad1fb27bdbe546fe22ee31a552b73ffcd0039d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 66.6MB
        • SHA256 68fbbbc35b32d6492db95f5a41dda087c10fb4ba2ceecaf5975a25b95f08c983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 65.7MB
        • SHA256 ab702af37537bdef6ad9af518fafee4a2735a68da6e8ec6552d6752f688181fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 65.0MB
        • SHA256 4032d23a8e0a0408b35e54eeba8ff535ecc240fd805dc4a66bddab9ed6aeda02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 63.4MB
        • SHA256 8c6eb93ef867b00bf8a4e77590183c0226b1c5f0783191558a01fbbf8af4c789
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 63.0MB
        • SHA256 57d291c54b99da0b401f19bed83ef1e25dbc65c4c0c85702b1a431592282c7f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 62.0MB
        • SHA256 9d7a867a8e9303ec061ec2252a89b45a36b1b78ff99a8efd1fd0acccf45924df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 62.6MB
        • SHA256 0dc588bdb452ad9472540783c41716e99150a9f6cb93e71424b1681cbad03ea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 61.5MB
        • SHA256 a0b0590649469d2f17802f537d133ea9ca089dea49a12e717607eed48c134e23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 60.3MB
        • SHA256 099c29a6c9126b27bc3db750379b281632cbb2df3ba3dcfcd83c3444e1cf8e55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 59.9MB
        • SHA256 54e19decc80495ca17b3aa10aa6a27e95a13f39ba91a2b379036eca535646d15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 192KB
        • SHA256 cc71df767f30aa32b4d730d3c0244896e3d45eb216f18568c46371d93640cac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 68.3MB
        • SHA256 c44d4ab33e7a2785bec7408601b908900576b58138a168c45bcaa993b2face61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 68.3MB
        • SHA256 1fb45736f3ad3f8a9e6fdca04c90ac69da537ebb626858f9c9f6cc1a8828cc03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 68.3MB
        • SHA256 945b677e6a8bf91601726602230f62e8015888a2521144580b7862df9970ef0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 68.3MB
        • SHA256 1ab5ab4a019ac3ea2141a5572303e18d7b0dd571b74882e129c207dbb2200a61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1676-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1676-10-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5364-17-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download