Overview

overview

8

Static

static

3

2026-08-20...wk.exe

windows10-2004-x64

8

2026-08-20...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    61s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 12:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_6bb21b7c549a908a9876b3ca6d249dbd_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 40.5MB
  • Sample260820-precwszydt
  • SHA256 70d5fdcfede79a4b043f23ac07259f5872a2cf62963de4230a21961a0a9bba54
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_6bb21b7c549a908a9876b3ca6d249dbd_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_6bb21b7c549a908a9876b3ca6d249dbd_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1116
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_6bb21b7c549a908a9876b3ca6d249dbd_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_6bb21b7c549a908a9876b3ca6d249dbd_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1088

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 40.8MB
        • SHA256 577559f6c0154351d01fc676f1259d257ece46f47162db979d147fcb8756ee00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 81.1MB
        • SHA256 1dc46081923b2007ba6b37dd64253e1c2ef09086d0988608cfd7c2b71d783066
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 85.2MB
        • SHA256 2e8da064a0c43464f19f80f573b95e3683b1fb893a0c7b7bac8be0a41a6df416
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 81.4MB
        • SHA256 ee47220c5db3a88ce44a603062e97bf798d2fd574a872ebb9e8edfc554509a7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 42.7MB
        • SHA256 3901f27cbf462b72fcbc292c45c0090b35a8cb92c23f7a9b5d368094594985bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 81.2MB
        • SHA256 945ad6925ec9c60771c14b1b01e44a41309f0a60552ff358b641b9876966edd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 63.3MB
        • SHA256 339b0b05bbe4c3e65a67d3290ee4d78115383798528d784ef80de70cdddb33b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 59.7MB
        • SHA256 373613cdf29109aae2a7722f0c573a2cda9e9910db80d25c8fa8cf90fb44b68d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 64.1MB
        • SHA256 b16427733d4af5de5dc65f7aa196c677f994812d0af538453a6f0cc5f11ecedc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 63.2MB
        • SHA256 3df0eb149ea2e3e79c49d27c85b176c97fcc8c93f1e503c0204ba5d20df381ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 62.0MB
        • SHA256 b392999550a976c05796243863f1ac13889fc7d0dc59d4be3dd514860369aa7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 56.4MB
        • SHA256 dd92c12a8558bc6727cc7502fb188dd32d535522ecabdee4cdb408958db7350f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 54.9MB
        • SHA256 6370f349d0ec948ba84facebc9921875eaae6f9846e5afb896ab8847b6c97530
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 52.6MB
        • SHA256 7f1f58359a938c4d20ba066572f04061e84300134bce0f3ad1a8a9bacab15440
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 52.1MB
        • SHA256 f4496f782bd29dcf1dd0b7c927f6e7e2a36ac2b4059d65f4ff3e6f5f0ca968e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 50.6MB
        • SHA256 f8d22db74cc33d4164520b312f3814a7bae5ba7f93d78becc9debe118793bba5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 49.2MB
        • SHA256 397fbf049af1579371c6cf06e9170dad51943a7de687298d4e3d14c03285b186
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 48.6MB
        • SHA256 81d6cc39a611b414cb3e04155d494c3f698499de148aecc9cb57d22df70cb491
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 48.1MB
        • SHA256 76023953be654c899682dd022d1ed6111a21163a8c399868b374797ab34f9d51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 46.2MB
        • SHA256 b8d6173db1d24737856473f316b307d54c5dacd7b410362f81ff342389ad5ae9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 44.2MB
        • SHA256 1bb4b9fc5565c4b89dc8ee4729ab127b49eac5ee4ae89e7bd2a7688f282e1539
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 46.3MB
        • SHA256 4a1620790ef1bfd5085e0f77087a27395a3b625a22be0c5159f959444e8eb92e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 45.7MB
        • SHA256 b5a5fcec37b07695565d23f47014c4746877914b3bad60a74d1af928a3d298fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 45.8MB
        • SHA256 e7b680c289a3b5cc4383f56c0c94b5230e774f79b139933fbc53134351a550a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 43.1MB
        • SHA256 8c214672cc5ed90b62b3653a0685035c11deb96b8e20e48822aa6389e5bd0cc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 42.8MB
        • SHA256 a3909e8097969a81d51c52398502ae81b779416d05873b17878c243d03d2183f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 38.2MB
        • SHA256 80ca8e315fe5fdacfc1e85d6f5645fbe40067a121eed58ebfa61522732771ac3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 38.1MB
        • SHA256 5817707edf0d7358b4dd2c91132c5ed108e7110ed3ec9c210fd72510dca5a9d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 36.5MB
        • SHA256 9b4803dd8b64dd4987906f82948c3000c960860a1c2cd8517baa8fbd1ed2a031
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 36.6MB
        • SHA256 cd56f51950f8fa1b8a56f0edeccf3565aa9077ccf0b8987abf90c3e207089774
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 36.1MB
        • SHA256 420c159fa77bbac39b0f05c021e739fe69b85a2444d4a22a8432676c97410b13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 34.9MB
        • SHA256 61fdb28dd53d6bbc2c09a66d78cea149add731db148811882175787bba274b78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 34.1MB
        • SHA256 8e7498f4312cf70d17bd883f485a463578c765fc6dcf7f22c94f1557f37ae3ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 33.7MB
        • SHA256 1ab36189cd1e2e620b7d16d8ecdc5cbc2761fa08f9ec04e81bd2d37baf70172f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 11.1MB
        • SHA256 ac62e4f1986139eaab4fd8d1c158196bbd16f2ea8e0fa9886b28ca000e9a854f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 10.1MB
        • SHA256 8ca55960052f5d2457bf070feb40fc4097d44029ae578065e527c1aadf236aa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 9.9MB
        • SHA256 0d6e6ff9b92c27dda69b85c8fecdf725c6aee14609ddf4f54073e9e641937773
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 9.5MB
        • SHA256 38ebcdca9ee8225ab6b70639866fd4754cc79e7c94d1b74251a7c5fe84342044
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 8.4MB
        • SHA256 7533131487187103998200bb7bb0f02e5291a7f3a302603f00d501bab7535871
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 6.4MB
        • SHA256 9ea0327c75bff0dfebdfe0638b512a91dff6b6883d85317b42731a66bbf503e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 384KB
        • SHA256 3e4e65210d0ce663e458df3dc7915e7345a65463edc2c4781b0feb1a0cd3389a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 81.2MB
        • SHA256 49391ea4f1cd3101f38f8ceb2e389c3cfdad2edb97ad488e9a3fb8eac87a9981
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 81.1MB
        • SHA256 521b359f4d60dae09f2e571ecd9bc7af53e997600d7450f60bd43487949e249f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 68.6MB
        • SHA256 39f4d72d998c39d16b52d17cadbaafec0cd4e055db8901a97e088ffeeaf87ee8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 63.8MB
        • SHA256 fc79b61c55b73bb2286d493edd8cf16ed240c0b81730f39077324f9230d2548f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download