Overview

overview

8

Static

static

3

2026-08-21...wk.exe

windows10-2004-x64

8

2026-08-21...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    44s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 13:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_651884b789669909af8ca1d5f0e9867e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 20.5MB
  • Sample260822-q6sdqsfb83
  • SHA256 6e9cb88760cf7859eab78da15dbb34e795aca93acdccfbca5010033907aa8e1f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_651884b789669909af8ca1d5f0e9867e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_651884b789669909af8ca1d5f0e9867e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1848
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_651884b789669909af8ca1d5f0e9867e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_651884b789669909af8ca1d5f0e9867e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:468

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 20.8MB
        • SHA256 711867b3c0fa0514d0d6b4164816b8dccbb1f80a692e627d36ae7640df2d50dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 41.1MB
        • SHA256 97b2a3784c5b5c93de3a2aa151e660d40731cc255b04685ba2f4a0859a460c6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 45.2MB
        • SHA256 ef0eac4f7c7b9d80cc496905847f477adea930c9ca0a471107da3e562a900a93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 41.4MB
        • SHA256 c852e43277d924ebbb5a12e8b782dd1824d7b02e28ebf84f5cefa8152101dffb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 64.6MB
        • SHA256 980e29c3e0126818ab53043a29a6b7b2d93f21f337d0926f144f731dc6b0d55b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 22.7MB
        • SHA256 ab45d02f8aced56b451c0a0adb0bafad41b6df175a4c414094388d8b6aa45f61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 41.2MB
        • SHA256 06d07268af5e383cb05cd093892f3cc1866bb09cd447f41888d2b18191c2acd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 47.1MB
        • SHA256 8771ec609490b06496ffb6c37a3fdd8bff74a5d02ed8d42e1105dc503dcd97e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 42.8MB
        • SHA256 19f464f01fbb7a8e677aa9024084efef33b28b5af6c770e6d81807dc12e9ec03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 43.3MB
        • SHA256 023f9d4907073498a62a440c72ccc780447a2761e6912008a389efd7d642d397
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 20.6MB
        • SHA256 4713aca210a49d94c11edbc46c028d26382ca9c2b358a99e37cd904d45d183b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 41.1MB
        • SHA256 18b03d9fe887bc3d4f5c6772a14363e6cd729df192cd92fa57cadfb7c8686de6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 41.1MB
        • SHA256 143e68812ae11fa440657d9c6537e14b756145d57e72e81787db9a7d07e3ca9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 41.1MB
        • SHA256 407c761caa7dd4d04ce4547cbea1d9dd599e1423244a0b8c779fd2f27ae7ff6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 41.1MB
        • SHA256 de6ab11a416a0c0541f5358f396808836adfa9a5b798a0a524f102274aec3664
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 41.1MB
        • SHA256 7da02957213f03a998b20ac42cca18fa864f44773dfbed49c5f02a586ce30cba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 41.2MB
        • SHA256 ad3ee96644efec1f06ba4259679178d3ea5f052dcdde31eb1dd4f4eef35bf318
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 41.1MB
        • SHA256 66cbd36b36c4ccc90e586d8ee42981e876f43ea410627e2390c2d8d13cb40c57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 41.1MB
        • SHA256 3a05f38cc513a680ffd61087833be9391d93d36387acebdca5a37875848497ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 41.2MB
        • SHA256 4a6777596cd5843b103555026d54f0ab486a5c485efd331ac13bac625e933739
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 41.4MB
        • SHA256 a6d75612c59844ec79f37dab9b53d9f22e5a9899373b35213aad674515ee589a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 41.1MB
        • SHA256 5167b6569ed9650f873dfad8e67b13ee89cb5a58fcbd41c159f83a81fb20befe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 41.1MB
        • SHA256 2e256457a7d8462d229c916ada7c653fc4fdecb252c9415da543cb3a4d102743
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 41.1MB
        • SHA256 bfe6964f800751c5b6b02eab6d4e65f22d3b1a01c38acc975e721f6be71a1ec1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 41.1MB
        • SHA256 556c7cc7650cd3b6c11c5bce0b0bb3a48a08d4cfca051a2c2e60ca246c616764
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 41.1MB
        • SHA256 4b938e5434b79387f4de94429eb915e014b03ce83dab5ca93b306bf478c278f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 41.1MB
        • SHA256 6330ef0095d611b88049fb8c893f62eeb1788ab772a38c3eac3e6d810f1f9314
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 41.1MB
        • SHA256 63919ab92f4a1bfef7320198739710b9c1d73888c9cde417351236445d35bf83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 41.1MB
        • SHA256 28b1283572a4428d6598d40e765993dfcb109bc3bc7996edb21b4cb9d6be351d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 41.1MB
        • SHA256 f5b10ce22d822a5b89af8d16117886072a033f66e975e76f5a15dd7028bdccdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 41.1MB
        • SHA256 25d787f597d2fa8a6086a5b20a826b2dcb75d173604c017ba04163466cd47e50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 41.1MB
        • SHA256 43f9eb0aca73a9093c7efc5908ca2bb59d54c3ea9dbf02a00445f9b5fbba19ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 41.1MB
        • SHA256 6536428dbe479d3153fac115517d62d4911048b381cce9e09384fea364373bd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 41.1MB
        • SHA256 8073e086ee4aa6f6611af0c42e3fda3b1659821f1d3093273d69f696430241ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 41.1MB
        • SHA256 98ad2e03ffd665a9e5b09eff17c9db2e2d9ed3caaf3aa2189fc1c9134fd26aea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 41.1MB
        • SHA256 8e144abddcfc4fac702a57884768e00e6d8173c3523d14e70cd2d815ff013414
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 41.1MB
        • SHA256 cdae533379303ea31dd880fd7b068bc10bbd1297ae4cfc5901dfb835b165f84f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 41.1MB
        • SHA256 8cebd431a821bd048c75c94926f6739fd3c45db4a363fbaee17a74cd66853837
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 41.1MB
        • SHA256 9baccc1fadcb74bd7dea963b5af350486e57a0ace8d98c2f65025273ab03388b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 41.1MB
        • SHA256 3d040c837796ffbe5cdf95a7437bcdd354345fd74a55c1d1b2f675b8df53ea36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 41.1MB
        • SHA256 91b4fbd97fd64488cebd7c42660f77ec8fa253ccd2ba158f236b862c7c6c8c70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 41.1MB
        • SHA256 316eae97ff4d0d0dbdef1d2645603c0d27c81793aa7fa2ffbf8b0bd00293634d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 41.1MB
        • SHA256 afe1fd38f01a2f7a38bf8d6fc4136636d4751fcb53e2f0148017cb7d5f1973f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 41.1MB
        • SHA256 ac8bb947f3bf4ff02449c993004ad4d9e9d758417615989e561ee0d53ad9bfb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 41.1MB
        • SHA256 74a13d157c506d96b662c02ff7b79ef84738db952edec59c0d5b68101e810921
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 41.1MB
        • SHA256 2127474288f9e2434886f82809ce536087c9fb4c3f3748cfe99b8ebcbabe6675
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 40.6MB
        • SHA256 ab7a03e360c749be3110d91c350bde9a99beaa9324341ef3e27f60cb38a76eee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 41.0MB
        • SHA256 f9da5ef39b6c0955d3df332fb9467206cc653d7ba1b2ce0c3d8406ab6a85462f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 41.1MB
        • SHA256 3f6d46b83e98f3ca485c2389ebbfb19c8f3df7ef5300a5bb8d5d75423483fe02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download