Overview

overview

8

Static

static

3

2026-08-17...wk.exe

windows10-2004-x64

8

2026-08-17...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    42s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/08/2026, 01:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-17_aaea7aa934a367131fd87faa123ce955_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 41.3MB
  • Sample260817-cdd4ra1emf
  • SHA256 e0d0e350bf37724113368d28fad7d7e565ae590bbaa6a32d00f53af47fd2bcc4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_aaea7aa934a367131fd87faa123ce955_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-17_aaea7aa934a367131fd87faa123ce955_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4824
  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_aaea7aa934a367131fd87faa123ce955_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-17_aaea7aa934a367131fd87faa123ce955_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:252

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 41.6MB
        • SHA256 e473636e440c6935732f028785f98371f68a5a4fc2781c3c38d17839248b716b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 49.7MB
        • SHA256 72ccd37477f11ab905b947a3e4bb35e170c3b645340a5870da0c3a85b9bcfbdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 47.8MB
        • SHA256 1f1335fcc9b70e518c3991a6a03eac5ee9363478c1b015c6a3a747da30c264be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 43.1MB
        • SHA256 093a39ea8a1ae2ab1a37206b2a9946161d607f7048d0f1bf2b0f6b37b123d0b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 43.4MB
        • SHA256 09775121794dd1ff1c203572d0e34d367314f2b125be6b38a086d632a1203993
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 37.6MB
        • SHA256 83873b77c76dac25e05af6c65d1e38729bfd47314cdeb6fa7d334bf27793a0d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 26.9MB
        • SHA256 4ca862566f849b7b84e39853fbb3cb89debfcfd9d6d1d8aa249a2b8fa3426f2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 23.6MB
        • SHA256 7ab61a8cafce7574fd6ce81b20920fadc824fef94617d855665cebdd79414d45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 30.2MB
        • SHA256 54c57e078475002d4765e8375537670a834855192ccf155b5f5070d72a6154d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 33.8MB
        • SHA256 c8d43f1eb8055110817f3d0054883175b42d9fad5908eafce16cf1a1925a8019
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 26.2MB
        • SHA256 dff159be715aae928200787b61f5d931014ca1a7d0a824ee64516c93770c3ff8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 26.4MB
        • SHA256 0f3fe7ac6306542e9f4492208967a7dceb69a5e167817460f26cccc9c522981a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 23.8MB
        • SHA256 e64b5572c82f18bec9fcddf00db6b74d6f594adc0f11a5679f27294dced31cbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 26.8MB
        • SHA256 cde9027d901dcd45510b15548d418eb6297fbcbd2f7dc30f9bfbf6e59a735863
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 23.3MB
        • SHA256 bd1ff43903a48979aa1e2549f7801e35f7dbcded98ebdaafebffaee17d7ebb09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 25.8MB
        • SHA256 1db0c959b539c0aa815bb3c3ba6845ebed07598d831cb385d444699a9fc33fda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 26.4MB
        • SHA256 b82ceec5eeaef05de8ce5532ad75829de0e7331aa8c8851397472b7200b14316
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 20.1MB
        • SHA256 0c62c0660ce49101674f1380421c70a7e704e428b4446572af8ee84eb9990382
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 28.4MB
        • SHA256 1b7f5a4af62bcf8623275e5ea14fbb61d8c1c8370901aeb94a9a16193fb38ed3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 25.9MB
        • SHA256 1868382eb713b93a2235d5dd2fbf167d7c319366ed965240aa4ca229bf7bbc44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 25.7MB
        • SHA256 b0b8adf86d00e2c1d0cfd31d9831fbf640fe0c793e5d4032d99b67e267f1fd8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.5MB
        • SHA256 30dcb328b66b98fcf7b5064e836141b93c21b409afc444f13725f8d448f0acb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 19.6MB
        • SHA256 160ca40e83ece126b3349d1c5770c612c5837058cfcd5faff60995c5ada4d8da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.7MB
        • SHA256 fc47d150cfa31a94edd2b14b8694bf38b980531743d5423c3c8076ca3384f461
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 25.6MB
        • SHA256 a73f71bfa398055cfb2c36c78160f5d287f497504a1341a1ccd7358813610502
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 25.1MB
        • SHA256 552b28de05c23998338ed7a22a5794e43b296dd5232cd527c8f8852cd3ebc452
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.6MB
        • SHA256 04c7880eaad4343a2d5ae994585f74f07edc025156e2f845cf54a58b53eb6a81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 26.1MB
        • SHA256 5fbaa92e238c51449491104d51da4a1fd7c3ecf6ebfc63055921ec0c7a2bcd47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.4MB
        • SHA256 48fb858772e10c856024128fbf2aaa5a94b896b7f74b7a8653a0615dcff0edf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 24.9MB
        • SHA256 d141d53c93bb70b3266b2602cd8dd03a5e3f6e1331b082e0222f6063b0da1a69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 18.9MB
        • SHA256 31973ffecaf1c270321ad1a1307a3c8da190eef1a6e6c9403199123cdae1fb13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 19.2MB
        • SHA256 b5bdcf08a43fa3971e5c56161a56a4a7c3450f9ac198e1d82e09a442d45e9c9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 22.3MB
        • SHA256 5f88c329afe5cc44944cf43f887ff37b2440db1a2d8403b548dc7200d082b013
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 25.2MB
        • SHA256 8b8c4492baca57fc523bad3ae792c9462ca09621523e1f6f727dfee873a53ede
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 21.9MB
        • SHA256 a240f8c1511bf3520f1d7ce2a04adfed282f3f79346db4d0c660d8d32b7c1688
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 18.6MB
        • SHA256 030c0f8a656ff6b2512b5f1c23cb56cee19b98a6a24ee3a351574f47349877e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.1MB
        • SHA256 9c33ce813790f2292a1f57268cc5485a28237697026db1aaac9ee3d6d8631e43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 25.2MB
        • SHA256 8a695dedcaa3cebd98af7f51e4e0a87f88f5d0fd00bc9d3927135befea017385
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 19.2MB
        • SHA256 e95a916391f1c36d953a2eb33a1fa8fd46cb97e4b46f7e54ac39c519654f846e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.0MB
        • SHA256 466143745eb71ac28aa0545cf63d2042c6d5bb1edc5f075e3d22d9a6108db2fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 25.0MB
        • SHA256 afb991cb6b4bd499715df5a03599d50c3432444c17ea1a12cefe1a775920d878
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 24.8MB
        • SHA256 5e96e2a114b29fb0646cc9b7e9ee466ea22ea40eab2db5e0d3c16de9e3538c2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 21.4MB
        • SHA256 62e37fd38090db24c0dc9a32bba15ed07fe354f31dd68b4477ef587ad6c01d6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 18.3MB
        • SHA256 8133fb4d60ee02b083458cf8611861a846ab7c412cdc3c79681f902fdd56ee25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 24.2MB
        • SHA256 7d51c6584ed88485ea311d9ac729324bb89a1e73a145391ad306a792cbbabf1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 18.4MB
        • SHA256 297eb1e3a4572620a6a8976cc9e18a8a0db60f306a312bd3eecbc23c1d21fb3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 26.8MB
        • SHA256 dab82ccd4004c2a74b12f8e9dbf096d29d5c309033d9396b74ee70e281f4a25d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 22.6MB
        • SHA256 c228c91648d6b8cdbe5f70355d858c6be6c187d6653ea9380754c9c96f511604
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 37.6MB
        • SHA256 86969677c4656bc4aaa4ce091e628944b6b74b615897fb9d8daff7d0060b80e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 34.7MB
        • SHA256 1528638700b3df7199108e79467588207981a35bbd7be63935676ef7642192d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 35.5MB
        • SHA256 465fd3c377fe96b0db7905cb91759e7edd5dad48ade8fcfe0a50696bda46a48d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 24.5MB
        • SHA256 bd5f650233b271c6a28cb625a18d28dc43892e93f00de134d565b3894e3d2b81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download