Overview

overview

8

Static

static

3

2026-08-21...wk.exe

windows10-2004-x64

8

2026-08-21...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    26s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 04:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_a54e02a5dc8e4b0d9d72e02e2fc93827_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 21.0MB
  • Sample260821-epekrsgk2x
  • SHA256 f5b50513023336549e79248e5434a4998349c386e78d1d2234953fb02994dd1e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_a54e02a5dc8e4b0d9d72e02e2fc93827_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_a54e02a5dc8e4b0d9d72e02e2fc93827_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4716
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_a54e02a5dc8e4b0d9d72e02e2fc93827_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_a54e02a5dc8e4b0d9d72e02e2fc93827_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4168

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 21.0MB
        • SHA256 f5b50513023336549e79248e5434a4998349c386e78d1d2234953fb02994dd1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 21.0MB
        • SHA256 090fac4d7d9b0cdcd78c59596273979e8d0c77c4dec343c311650dbb6fc57856
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 40.2MB
        • SHA256 88f3680511ec11e30d54cb789fe0c5ad5a304022616815ca93b47925182d3cfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 36.7MB
        • SHA256 9b54c4f63e9c0c9ef41662c95d5b84590033a22b9c55fe201c488bdcdd29b90a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 42.0MB
        • SHA256 7dcca4c24a918c23eecade4a159d33af31ec2165019bb32d6519c35361c66841
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 21.4MB
        • SHA256 d5a6f925677fe0f0367f7a5c636160f4667d346ff6eddfe1a6f0f856a3233d18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 38.0MB
        • SHA256 1359eab4d0dc92ea528402d3297572dfc17a9e8bc6ad7097ed883016ef034b71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 40.9MB
        • SHA256 0329f853e35d48bda7db7b7198dcb523ea2d044c3919417b6fc487e630b27e98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 35.5MB
        • SHA256 a998d4b9fb85c8d37c274629e0714a97fc08b5bc5d5f705727c3914ab1c23993
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 32.4MB
        • SHA256 495de7311de25d10aba8ac99a8f07ea10d342832c3a5569c0b801ac2a35f5c7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 30.9MB
        • SHA256 109c3380f4e21fda053a10619782c0f91dd1f96f973a217d528851246e8c1444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 33.6MB
        • SHA256 124db6f376677e47064b7f0dbdaec16c3c02ee73291d81737711ae1bfff2c1ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 35.8MB
        • SHA256 e78713cf99babf067671451b298bcedd99520c089488a7f2e862bd9c5ec390da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 32.5MB
        • SHA256 530d4f72bab66b7f5383ea7f75a6d531fc6f521d7fff3b97254bced24d014ec0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 31.2MB
        • SHA256 405fd3cdc8f214f6dd53e644f02aab4377e87a6c568055e9906001a8f70a943a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 32.9MB
        • SHA256 7d5f7d0c65be62c6e6238bb1c3a7f3e6801353263bd245ef2ec7471381504634
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 33.1MB
        • SHA256 47acd6800867b89def3ab3b0b99f3ade8a2d9acc8815e97246339f0e75c84558
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 31.1MB
        • SHA256 1ae2ab7b1256379a2b9916eb70677d86b902cacb2bd56eadc8357bfa69daf073
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 28.1MB
        • SHA256 7dd7d12a2debf04172e531d0d1321ec857451d7784deb745825349a54851ab6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 28.3MB
        • SHA256 a992ba235424e11aa875582d5019192700c4acaec53871b5ca73a45a61f05459
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 27.9MB
        • SHA256 2d87fe7a75dc05a1f6762bcc8953ca110bbf5940d21d223726fbeb4c95057ef7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 31.5MB
        • SHA256 d03cb4f9204256c268908dfac84b3b28e5763f103e3499b9fa5f74c4fc99fb3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.6MB
        • SHA256 8afbd52ac1496727a7702d1b00c791bd55ba6eeb968fc1228a246a83382444a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 28.9MB
        • SHA256 25d4df3f89a69fb8291576b488ecd5ab8d37150025f083373920a54064cb253a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 26.3MB
        • SHA256 48f001f0b8d2d61c14d82bc6db86c480cfda52d4dc8cc32fe017275bd2f38dab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 30.1MB
        • SHA256 2e45b911d135c6adb03802f76f8d65d68c62ef4f7c1215351f34157a42512a9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 29.9MB
        • SHA256 b4deb4244cae910eaac449df41667d87cd2fc3e1d1054ed244ca830285e8cf45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 31.6MB
        • SHA256 018617d0987d0dcce3b0d7cf6720ba67d60b47e37aae0c438b0309471f95cde4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 27.8MB
        • SHA256 b0043c879a578224faa13424b384fa09548823609b714daa6eb7e89f73993477
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 27.4MB
        • SHA256 b0b59d9aeda52f84874014a250839a43f12a9cd953aebc3d8bcad5e0484f771a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 29.8MB
        • SHA256 3b93e25ce26b1e6f752db9070fa0eb75599926cb60d15007fb56301c8bb339f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 29.6MB
        • SHA256 c9de5f82dee6051b28ab38928b20c2606dd402ffeeec1b236b85c804aed0fad0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.0MB
        • SHA256 ed5f16bb7c826a88bca78d92a4a5f73706ce7081c81be7247704a4755c01289e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 28.5MB
        • SHA256 134a4116a4b8153ed3dd6fe46de34a5e41e079d8f304fac6c95e22ae53f03c3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 29.7MB
        • SHA256 4d2c9e71136c3c62c60c0c7ef00de2de40965820d3b6df16617126d45d307469
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.9MB
        • SHA256 912cf0aa8eddf88962ecbedfe1b0c00697031f9f48916ce3eff23b3a412551e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.1MB
        • SHA256 a83d5c2f1eea817974faae268dabaa30173082e0b88fa740adc588ffef1c6c37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 27.0MB
        • SHA256 fc773f48fb4848df4dfea760979e16d33bcd399c33b4c42d4aa8b1b9227fae56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 24.7MB
        • SHA256 3b345c0816ea9a4c79b99357703f17c1023efb695cbc1b74234c842716ab89eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 28.8MB
        • SHA256 ce700e3e61e00bbb9d36fde041430c86cfa715ab30413c14ce57bc68ea12d419
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 27.8MB
        • SHA256 d5b444cdd4f829e7970a78dbbf2ee1f70477acca1fa2686f4cc0e96e4f97b1ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 28.7MB
        • SHA256 68df69c744e2c852efa0ba0d8542a05e938dcacf888092ac38d11cb2460fc71c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 26.5MB
        • SHA256 7a9849f98b70ffe56e72638da65d301adf998c255013b4d2a0ef0ee5f7311c7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 27.4MB
        • SHA256 d2d8c378c8e44e9525dc53518a8293923879abe8be0081a929e92b3074b79a44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 26.6MB
        • SHA256 33f6054c1841e9eb7d7bb1a73a647ae036b8fd01aec5cbc13356fe9fd7d5a53e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 23.8MB
        • SHA256 90ab7e7d61de822952c2cf7161c7f592b9103ee68a883dfecc418765aceafff0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 23.1MB
        • SHA256 a49d3e35f8b66b576b72fde92e2c5d8e46f30e054b4401f9138d70ca41f4e72e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 26.9MB
        • SHA256 8bc098fb643d8d9f5141a1b25de14580ad3a0b94f6c8e2a4fb0ca802f52248ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 25.9MB
        • SHA256 febf22fd7939155e7193545f219cb06e67dbc9245af13a161a5edc29bb35f258
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 25.0MB
        • SHA256 4e47d8946a71d0a4cb8361424ae42ed28689c53eb195b3e0080c9e77f9bd2ecc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 24.2MB
        • SHA256 fcca95f4b620692695b9b6a9ca1ed8c828bbcec0cfcac1f20e05d62b68c71e2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 26.8MB
        • SHA256 a96baf24aee221c78c1cf9a5d7ff10654067129d8a0c05e867ce795e8e6db5cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 25.8MB
        • SHA256 75bf055bf508dfd4155b43d14cc793d056a900053ffa32cc11864547d53f2eeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 36.3MB
        • SHA256 381df29e89714d3cbd6a7457264c5585b7818794839d16535627775a4638e6ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 35.1MB
        • SHA256 7a90b3ad48dd65fccf0a88fb186abca050b6a4bec869cbe876a99a770b6e0070
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 35.2MB
        • SHA256 3615f44751d58375d23480f7a91cf442c60c686ea783b022e523fbeb45cc4843
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 36.2MB
        • SHA256 c36fab449b155521fe8719f621b3d6d685601f3e119b79555a93dc8588092a11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download