Overview

overview

8

Static

static

3

2026-08-20...wk.exe

windows10-2004-x64

8

2026-08-20...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    41s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 09:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_784f212f9f89f6cc82eba39de3cbca60_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 40.3MB
  • Sample260820-ly5a4shr8s
  • SHA256 63d2e7ee96bc354dd5eddca28b09465dd95b223bcce2272d91e2be39baaabb32
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_784f212f9f89f6cc82eba39de3cbca60_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_784f212f9f89f6cc82eba39de3cbca60_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5616
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_784f212f9f89f6cc82eba39de3cbca60_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_784f212f9f89f6cc82eba39de3cbca60_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3948

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 40.6MB
        • SHA256 da3b4e38bff8b7e910f835abca858083eba637c5f0b8d441c200ccb51a96857b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 44.4MB
        • SHA256 554310dbd3f9feda1b0118f7ab7b9798be365177c035bd298964de2f853184ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 81.0MB
        • SHA256 04c3da586deed034b3f565d223224cd39297dcd894ca66fe4cfc0dbc117c8469
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 42.4MB
        • SHA256 024353ed30f5c7d3370bee3cfac29a471726f9b2d87bee42c368d9b4b1a069ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 77.4MB
        • SHA256 d1eadfe708a34fa54e1a803ddc5e8ba9e10d7e87ce6ed50ec8edd8451c5bbaf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 62.8MB
        • SHA256 b56e86e64e8e415796294668bf899b793ed83b577ac472a95079cc817fc47ea0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 62.9MB
        • SHA256 1f15ef3d1bf38876fa20c203c155c3d0dc3da974835220d53f8826c8b013a224
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 66.0MB
        • SHA256 14bc4ab77ad311cee249d1e1c1594758eeda4494f15dec6ded7b86208b4384d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 65.1MB
        • SHA256 b87cabf764dbb5d37a2514bf96d23ebed7a1f98a1a2213d5bd099bc8015258b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 64.7MB
        • SHA256 d41e29bfd00d1a5eeeac641e31f37ee03af67aa286d4f2900105661b3a712d0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 62.2MB
        • SHA256 53c24106fcac5bb3fbccae5de402ee7b8202cadd3b6c6da8fa9b01713094ebf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 59.3MB
        • SHA256 c8cbf178d925b3215c1afaf9058bbdb61cdf9d71cfe81882960996437dc5bb70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 60.5MB
        • SHA256 ee3bb048408e6156d0aa797d5371b9cf74f3462b6fd58ac7257cc01e4591ee08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 60.2MB
        • SHA256 5ca3d5e04104ebb85a36551325a30fe47d990a3c49a460cc597ac692a1cf63d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 58.2MB
        • SHA256 7b37658c58036531add609ca0b287c6dd66ce38d0137fd5f03f107ce17d0bf0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 54.5MB
        • SHA256 c2c7bb7633ba0e9b091893ec469243ea77cc13f68cb42f85fc85f70cb6e4233f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 52.7MB
        • SHA256 b18458589bb504a294bc1f0fe3fe605daf1eda78a06f93e521f54083efb892b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 50.1MB
        • SHA256 a898cef0f75423f533334d57f7e8fa0be41d8481e3ddb589f14d9dcc741e700e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 47.2MB
        • SHA256 0f715b34412978ef7287e01b21e61eb84aa1104bb567fbc646cab976a8353b93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 43.2MB
        • SHA256 43cf9b991ec56d2aa5400b1b3e979585270f9d571fc245e987acc96bf5c00f42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 41.8MB
        • SHA256 ff3fb14c8a6647fdd4c22fd7e6cf929725b374ffa4d849c36fd903da33f30604
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 39.6MB
        • SHA256 eb3082377d1a83e7fc2e714ef43ecfab76f0c624cb81d56d2194a1adb98683d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 38.6MB
        • SHA256 c99a41d2065889e67c36aefcb9cd61ee5a1ea583ac370a63773ad5c98095f79c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 37.6MB
        • SHA256 4040a73cba9f56954eb3ffb48791eec359d81a6c3dc293e651fcb1422e241d81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 37.4MB
        • SHA256 ac759ae4a427975afcb3b75011bfbc0a04367e0ef8651e552d2669b04564b634
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 37.0MB
        • SHA256 ea26f18957fb4a552ebf0187861bb7c19cbaa151bc057180862fc1ff075e0f95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 35.6MB
        • SHA256 652e80a0abfe5072640f56164c38e9eda08a07c79522591c5120de694cfb7c98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 35.1MB
        • SHA256 04c089d17848f2ba29d31dddb8909587db95531c6ffd4cb5cadff299985c8a01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 34.4MB
        • SHA256 3932d231a06e08a9aa92a4e4bc8903cc7c82883404fcd4b627601f7decd1e188
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 33.9MB
        • SHA256 fa1af6fd91e1ae7dd3981cf87ef7629cc437a04143e6475e166fad8a1a30a409
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 33.6MB
        • SHA256 273131598e3d054a3058637857ea04fcc647029c7864892864099b95eb7b76fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 33.4MB
        • SHA256 8f3734bca415cf7a47e08d4ef12d53e665c142a85a2256496eb133d7e7381441
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 33.0MB
        • SHA256 6b883033fe9eefe36045efd0ac513b3ef0ccdb0252131252d1d73f54254ed8d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 32.9MB
        • SHA256 de92c80cd0c1c32bfc97eb47ffb5409c07c90b9a297788dbd514ed780f146132
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 32.7MB
        • SHA256 76706df92f6c5a47809caacf6bfe39582cd64a41819a22b2ae50274ca91b52e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 32.3MB
        • SHA256 84172a81a16ceefc143e9209857c9809a33d58d6f5cad85465704fe4cc16453b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 31.6MB
        • SHA256 fc59523fcb53646a8fe61c62fed19ce989e80943e9f82a2175f08713ccf05458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 31.2MB
        • SHA256 56c0c77306f6bcbbeba772e23e78a7acb918c144af10e546ecbcbbbddb82f3ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.7MB
        • SHA256 8c61985f793239ae927041c5236e14c693e455f76b38e97413b321fb9771b035
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 73.8MB
        • SHA256 30653237bcd06e3bff60a323b33bb96bceca501fbdfe8925c0d3ea6baf8460c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 71.1MB
        • SHA256 77adc22ae3428b2441ca08ec65ae7f44a4107303f6b23596cd4ed9a5657da576
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 70.0MB
        • SHA256 cd3bcc10b9cb4704cf851967ed6bfe85893e469246eb1cb13f5bf34ab395be3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 68.7MB
        • SHA256 88e092851b3bd9c8dd99e52b7aa267ab96e40b09690c911ac249a2e485ff505f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download