Overview

overview

8

Static

static

3

2026-08-17...wk.exe

windows10-2004-x64

8

2026-08-17...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    46s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/08/2026, 03:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-17_398886fa0a6d507b0f4da55ebc2e3113_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 30.3MB
  • Sample260817-d7sdxasflf
  • SHA256 d4eca71ba0b014a4740ed21bafba5f2884e4e212fd3e6fc9815eb61a54194251
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_398886fa0a6d507b0f4da55ebc2e3113_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-17_398886fa0a6d507b0f4da55ebc2e3113_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1020
  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_398886fa0a6d507b0f4da55ebc2e3113_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-17_398886fa0a6d507b0f4da55ebc2e3113_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2592

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 30.5MB
        • SHA256 d792bbd60c76ef23fe1bc34421af486c1a533358470e8b994c80baec186dd8c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 60.6MB
        • SHA256 74f2c5bb3010eb8df35a3b8abce0e5e17f2983457903d2dcaf1b85ccf7ffd61e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 64.6MB
        • SHA256 02b16ef95fda441960202fd232a750f1a3ae051fd4eb1eeb3c66222e470cea8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 60.9MB
        • SHA256 049425687024f28b21f322070cfdcdf468d87441bf64cb2d15c69ad16dbd95b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 32.4MB
        • SHA256 93caee4b3752c04521c7b06337986a44db43ff3ba4f32c6a1e603136e9d11401
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 60.6MB
        • SHA256 5fcf4f81b79a8f5d9b53ce773cbbe8734d2f49cc304531bc1d2fc6d0890c425e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 66.6MB
        • SHA256 2d8a9400dc749580cc0930f018abecd0db7ff05304ab1a1d798f8368796caa84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 62.3MB
        • SHA256 4d16a5e88df85be4222e3e76644073865937827771ce6649c902a98fe1bff82f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 64.0MB
        • SHA256 7f0945c38790bfa7e521fb434c71755d4b798eda268d0479368202d046f551c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 62.8MB
        • SHA256 4170fa47c70c3f6fd4b1b99509bbc07d96686b0065ba3be9187dbdb9288b0b40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 62.2MB
        • SHA256 cd7d026aa6a9b2114ff42badf34235689e510a5d459a4d301fba986a59d24547
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 62.4MB
        • SHA256 d007ffa1fe3788a311582e973e0b1248b007e614c65f8a90036f0590849cc529
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 63.6MB
        • SHA256 bb33abedee249cd901a8adde7edde48ee63f244625eda67418b34187bf174ccf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 62.0MB
        • SHA256 836d5ac6acf0f44f40d55ffda79f29e8ea156c840079de8bfbe46b9972130e60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 60.8MB
        • SHA256 24cd4d2ad35c15ed88b6efcb99a3c83d6651afda5ebb5518792fb8ca12175d89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 60.7MB
        • SHA256 21551e4cea75653629eee760cc6e9b38d378278ded088821fe57c035448c50a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 60.6MB
        • SHA256 b2486fc9d3e1b44b77464314f16166a29599b38b20bd11ccb5c3a8bcee6e6c19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 60.6MB
        • SHA256 c889debd086654bc67405631238658bfbc1fd8a309fb4f6bd5d17be597d9ef0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 60.7MB
        • SHA256 d9710bcf50a3998931200f2f94e667dd9a016c7b2f92840ba0d25d8cfce8c246
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 60.8MB
        • SHA256 a37597fc7a5f3a1d66f0421b74e852e88a8bb7e7301a49a964012f21777732d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 128KB
        • SHA256 018b597827351ef5fba9c0e1d321cfa9b45d887ff0f8d5607452eb75d8626cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 60.6MB
        • SHA256 3f53a12809ba615f2dc3004128de736753262beb782a5dcd0cbc959a52c104d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 58.5MB
        • SHA256 76162c467da676a84d61c00543bf312f3b86cee8214e2bf0471f7836f6cfc86d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 58.7MB
        • SHA256 71a1a6e836c2c1a6d37dc1de9d4ec300c2b52fd585bf24fe13fa7b31568065c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 57.5MB
        • SHA256 734d1c1a189dcd915f9aef770c6bbd9a5b240e18af15bf30d3b48448b911a3e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 57.9MB
        • SHA256 d629c504c40e4dc0262061321b8f5bc65684844bb8ef9424aef69b73309ed65c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 56.9MB
        • SHA256 3a8791b62e5bf6487380eedc021d9b781c9bd5273f78ac2f4f38fb0d5d769698
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 56.1MB
        • SHA256 3324ffd80df6ae3d43540c072f95c304cc467494ca8db1d7ab8136253904fb94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 52.3MB
        • SHA256 62c545c059ac7ac9253a597aa7fc641a4f50903262880a6d5473120b14c3290d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 53.4MB
        • SHA256 c7a560001594541dca4d88a7501613c7b1eddc2082023c5aea8c487c27e3dcb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 60.7MB
        • SHA256 835743d954152bc37801e63ecb0a97dfba1ef46992e8a82d93a829f574268a89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 60.6MB
        • SHA256 68dfdaedb20c9090046967115feab44a9b10cf284b7a95abda12b0843fecb059
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 60.6MB
        • SHA256 8ded942d27ffbb8e5950080194929e4f28136501f6f105cf0037898420e89083
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 60.6MB
        • SHA256 f665f7e8d40c7f2ce173967a705ed013b07eadcee4d0c288293cdcd6a2c9d013
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1020-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1020-9-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2592-27-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download