Overview

overview

8

Static

static

3

2026-08-20...wk.exe

windows10-2004-x64

8

2026-08-20...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    40s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 13:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_05deaa353075b338c2a203b33e59f449_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 40.8MB
  • Sample260820-ql932sdf39
  • SHA256 965c5b17de8ce643850edc4426853d63d07f33aaec788d90af6780567e1b76d9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_05deaa353075b338c2a203b33e59f449_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_05deaa353075b338c2a203b33e59f449_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:936
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_05deaa353075b338c2a203b33e59f449_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_05deaa353075b338c2a203b33e59f449_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3380

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 41.1MB
        • SHA256 639624cccc2acf8c2b0cfc9c51fef09a558e3a71c5b446799ecf1cb123e0a02a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 81.7MB
        • SHA256 9577554d7089b78489df65c6c51b4aee38b7864d0e84a357469f560bc2fe727a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 78.1MB
        • SHA256 762a2516944fd2762b4250568a60bad6a822eacc42c350e91053c6a2a0938128
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 77.8MB
        • SHA256 ea6cd291c2118d1a7fcd6e315a0660f2d1a4c01b90c24cefe7480475dd779c2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 43.0MB
        • SHA256 da2a4186a052be4d22504f6f63b7325ba911a7e9ab47a0ac809fa2a2fada6185
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 71.7MB
        • SHA256 f165d8aead2c7ff3c651c0b648d2a9b2922bd5393ae1a6e554773d926ba3d6d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 62.6MB
        • SHA256 f06f1b6243baf555448c1fdfb82a33749c5b8042247268c89033dfb8b24c4042
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 60.3MB
        • SHA256 f48a775243c39f2efe220fa7e99b55ee50e3e7b2866a14b3553d9a0fec743f9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 65.4MB
        • SHA256 eb9332efb2ed26faed1da14450919b918b9326356f6873f973ad85778bf99053
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 64.8MB
        • SHA256 61c871c1ddbd82d6c9477abfa737be304ce3cf2acbfc3bca37a8503bc9b22a03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 65.0MB
        • SHA256 434f8c9c9c36d3f43eda2c098d83e379e8a1928db943b9c6fbe72567bc2266e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 57.4MB
        • SHA256 9c735ad341185538c746a6248a8b2115db845d074e817fc9981e679e1fa15314
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 56.8MB
        • SHA256 64ea9cc74d14e566d568e8de60a68490816cf505868cc6db1da9fb74f0d0b323
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 57.6MB
        • SHA256 cd06f26bb9f6fc0283216bc134732d9e1722ae2c1d244c2c8d9817fce3755b8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 56.6MB
        • SHA256 b201d920db67001095567208d0bf4f8766051f1c7148c2960e93474070548169
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 55.4MB
        • SHA256 cff35bb1952bfb55c098708c6b22491b62694dacdf0246377761d6eae45baab8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 53.9MB
        • SHA256 fda05914b1fe4054a768d8ae578483c2724bf615a87320c14517c11c8ffb76ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 53.3MB
        • SHA256 4ba010d659503bdf4bfdf200c4cc95637ba31911e45957e931b6bd9115a9c500
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 50.5MB
        • SHA256 9cd4d093ce1750fc13f959c4a235c32c3fa3011d75cfe840d60f814f7c496ebe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 50.4MB
        • SHA256 4413bee5ec74e15ee27462815f9f84caab58e5dd16a16b1334adbe6c42ff9189
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 49.8MB
        • SHA256 e2e2628a8f383e433138483de5562043226b62ee50e145e4a9d6b7d59815552a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 47.2MB
        • SHA256 2af3a1462eec8db9a5a54d879274b72662dfe729d4576b695e978ecf3f5d09e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 45.4MB
        • SHA256 0fa8aff8ab3c33060dd6784f082ca88033738febe01cbfb6087fabfdb1e13df6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 44.1MB
        • SHA256 5aefc470a8a2919e358449cd211afed21913b0cf768fde8906e862bd6016b11f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 42.9MB
        • SHA256 a5432a6144f358d1d5202d93aec106db96dfa197bbebab37e7ff71ae6ae96220
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 42.5MB
        • SHA256 93f51cd553adbb04fbcf45844c06257012ec839d4d3ccabc2b5dd3a3143422a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 42.4MB
        • SHA256 595b3a03ce013847ef0b6ba978bc75dd331a84a8692ed923de5ce3eab718be14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 40.7MB
        • SHA256 5daf9ffb179d023e9f313dc627eed2f45a851adb52a873385f237c8ac829349f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 40.4MB
        • SHA256 3262f4e32a19ffa04456df1ee2310fd3cdda2046982f1ad89381f74501426df7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 39.4MB
        • SHA256 4310401d52941217a3c3723f02617a0462048edd2a468814c4ee5085c2061605
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 38.4MB
        • SHA256 0ad4a896fa877182a48a6271b95aa715f1ec572445f3197c89e85bd67f507c5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 37.8MB
        • SHA256 1966ed3ba830652ed7171b8ad8f79b38d4b2098695fe9e6b8dde6306ddffdbdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 37.4MB
        • SHA256 aa1fb08caf36382df1c2fe8df5f20aa36f7629e624d69deee8fceab41d70ed7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 36.6MB
        • SHA256 3d038abeeca34cbae071d3b28247520e6c7cbf0ccb1441099daadf66b43c727e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 34.5MB
        • SHA256 952ba38133a5fbe4dce1f6176107150aa2c57bbbf67ce43ec6f1ba36f0489cd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 33.1MB
        • SHA256 d33a0e262956172429452546eb3d338703682f598cc40e9d93c77d597e207d2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 32.6MB
        • SHA256 34cfef1d6cfec40591c9849eb8b99f9ee1bf39c5f709fefe6d49eceb02852e1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 31.2MB
        • SHA256 5f06c0e647a6fe1b3884d1c5a05823a919996e7f1c0a5890b82f65dd9aa5a206
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 30.9MB
        • SHA256 453f605b9178e6ce0b1cae475743abd4b3f2f1ee72ace5cde738e210003b1bd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 30.2MB
        • SHA256 e4a787dac97ccf235f34d22cd3bcbf1bbcf2ea03d34ebe5e21946af2a56bdea1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 70.2MB
        • SHA256 f34590f509e4dc7567d21a762f5ccde828e4c823caddbddbba5d973b054682e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 69.4MB
        • SHA256 a347b261ab40c060d62b75884d75f1feff4180fe0183eaaf8e4e242b88037efc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 68.0MB
        • SHA256 2db75ec5f63d704f3d467a884890462d6bc9673c0ba43fa3bf28610f4a916c89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 67.5MB
        • SHA256 ff6de538eef3ab8576c89e2a4d382344f3ae780c57234b62e44a4816badcb338
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download