Overview

overview

8

Static

static

3

2026-08-20...wk.exe

windows10-2004-x64

8

2026-08-20...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/08/2026, 13:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_05deaa353075b338c2a203b33e59f449_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 40.8MB
  • Sample260820-ql932sdf39
  • SHA256 965c5b17de8ce643850edc4426853d63d07f33aaec788d90af6780567e1b76d9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_05deaa353075b338c2a203b33e59f449_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_05deaa353075b338c2a203b33e59f449_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3612
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_05deaa353075b338c2a203b33e59f449_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_05deaa353075b338c2a203b33e59f449_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2868

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 41.5MB
        • SHA256 3d891d22d78d2d0d31a7a9b5d61a9c30ef37805c84704f474ac2f46e154a8b88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 87.7MB
        • SHA256 5cf0d0679c7ea8a2f017638e31bcc20817b025c1142268fe39ceee57c589031a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 83.9MB
        • SHA256 99a12d326c484ef239d46c5e481d83325aa420872e8d664478fd7e17cd735608
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 83.3MB
        • SHA256 b0d43ccf836bc22a7ee637360ed52bb305bb85669c053cbbaabc87d7aba5d724
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 83.5MB
        • SHA256 8f4b7b3d74a558b89e65b2d6c55b227ea4b3bc4c0e0b705d44eb15e1c31e7d15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 84.7MB
        • SHA256 a6a8006d0eede9f7eb192477697e1307db7bc65076bb52a3685324488dffd463
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 42.2MB
        • SHA256 a73f86febc024188bb1e5758fe1b2cb059673d0c28006df22f00ddc0c788c691
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 81.7MB
        • SHA256 f9f003bbc8f3f0b369bf19e424f363b2e5a140827f354799c95c37e572da2db7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 81.7MB
        • SHA256 83262a6d774dfe907781c5256d7fa1957c7e2f87eaa38467548cf9d3622a4e6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 81.7MB
        • SHA256 97fd940cf71187c1347cef9cd628c0c31a2788631090e8ada06b4377ed038934
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 81.7MB
        • SHA256 cf548429998c9a4a921c3dbd108df990ab50141e6e6fb0c919e511da50190deb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 78.1MB
        • SHA256 762a2516944fd2762b4250568a60bad6a822eacc42c350e91053c6a2a0938128
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 76.3MB
        • SHA256 56607847b67f050765139596176a2e7ff1416e9fb18b9b64aa7d760aa315e8cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 71.2MB
        • SHA256 dde78fb3cdd3fffe2349bf2fa926408e428fcaa749c7a666babfe6d8b05f5df5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 71.2MB
        • SHA256 e4bb10306d00e3ebd6ca3f90be985cd29a64e67f07ab1aaff16a3ab16122c274
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 69.7MB
        • SHA256 64de869a56975ae9d2d288564e7f9ca822bcee3e00bc1457ad3bdce056ad9e7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 68.7MB
        • SHA256 691febbc118f31ce080a3bea0bb6652e4de6e0b33c8ea78033df534a74f0c33a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 66.6MB
        • SHA256 3f703854b5a628a8e12d3a02ef1bf24f97f3ef6185220c48100e30a8c57dff1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 65.6MB
        • SHA256 c1b3ccc47718ebd823f08cf672c57a23f9f7a0a47a0e0e2dadd7f2b07e36c23b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 40.9MB
        • SHA256 52f3777e3cbbf4b6540b0368fd8b075f71e5e8fa07e2c4fa0c43ab776704e16e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 40.8MB
        • SHA256 965c5b17de8ce643850edc4426853d63d07f33aaec788d90af6780567e1b76d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download