Overview

overview

8

Static

static

3

2026-08-21...wk.exe

windows10-2004-x64

8

2026-08-21...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    143s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/08/2026, 16:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_3ef97295d2d2db07a9c87aaef9a63b90_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 46.0MB
  • Sample260822-tpaddafe72
  • SHA256 73529beefde9f4afdf86700b0a187cb904eae5d3392605b1af0043fc9281dec4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_3ef97295d2d2db07a9c87aaef9a63b90_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_3ef97295d2d2db07a9c87aaef9a63b90_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4424
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_3ef97295d2d2db07a9c87aaef9a63b90_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_3ef97295d2d2db07a9c87aaef9a63b90_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2140

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 46.7MB
        • SHA256 ebabf98fb493c007ef8ae7c048596a841f5b52ebaf4d10714fc19bd2e6cc0e0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 92.0MB
        • SHA256 ca3e2311acc04f8168f24f8f90dafc931a72dea95a810c94b4f4f1c2f4e6ca94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 92.4MB
        • SHA256 721c376a9e1e150475fe380608fe811a33bfc02650c3ee5ec939d352b3dca6b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 92.1MB
        • SHA256 64f28682ec8a8eea1a3dc37e81f5eaa7731f6ee8fc08d6218f9a7b7188c39ae4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 93.7MB
        • SHA256 9c6d032a7a5be42f60f3c1a5295279798f7ece2603e1c11f06a3f23f3d07343f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 95.5MB
        • SHA256 1ff613d2e9c5131a272724c74dcf98a7cc7257b779f8c38f1364a06394bfbebf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 94.3MB
        • SHA256 cdad851d46ee2fae333115a114ec474a3c670fbeadb95957f3b7d3f72f51f1b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 93.6MB
        • SHA256 499ca584757faaf74b0927ac8ab28a5864b129d4efa085a2f4ddf61aeb19fcb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 93.9MB
        • SHA256 c424cc65b2dd913736852d9ceb85a96ae8117b01bd85c775e9fb459d4c21fbc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 95.1MB
        • SHA256 78ff271469edeadcd1dbcaed017ba8ea39d26005fc23d8a9c2d048f2b6a395d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 93.4MB
        • SHA256 edf1af2205ac5fb1739771187f6cecc9e1c667fe4d0abd271735cb77476fe971
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 92.0MB
        • SHA256 48150d2bcb800ada0b3ca3bd2eb0e7c67fe2cb16b9d21ea085ee84be0a2f457f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 92.0MB
        • SHA256 647b4671e43e5df6200f28097f0384d0adabcc82c046d9059509ce733e3185e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 92.0MB
        • SHA256 fdeaea8a9130366086b147c9814f42bbd0fb90b5d7484e57e6d62b5c319bc455
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 92.0MB
        • SHA256 58a8d4d8e2e030dd7156ea3ba55d4a490d15643e28b12760f131506ccf7d945a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 92.0MB
        • SHA256 8959b17c1efb14134dedceb2acc01e9cb4ab3a75daadd88ada849e8df7d86570
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 46.0MB
        • SHA256 b359dbb6fa02862d3de318be3056454448267652044b30739f576726b6103735
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 29.6MB
        • SHA256 cc55fe734a8a36fa17c0a991414ec0839fd9d7264223e6ae8807b1c9e8e1c685
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 23.6MB
        • SHA256 bf67c5edb9862c347705808aef8f9d11e26712047ac31d172c5300008ddfab59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 20.3MB
        • SHA256 3d1c33a8b14e376fcf34d531cabc0f91736300796fc0523a6010c7d2991240bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 18.7MB
        • SHA256 4ada9d4077ee40ae6eec523b55ccd529338bef593d1f531a334cc1adba67ca2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 15.8MB
        • SHA256 ad55c1ebc02c1fd2d9185c91d8edf761b7d25494769e58bb76e94f97b91c7059
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 16.2MB
        • SHA256 ffaa3dab5237ffb1ea6ae6cedd6321969b8968d259cde8627d6b5acfd881c8a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 14.2MB
        • SHA256 ccb1cd00ca7df774c205c46dcf40288c12ff20ae6956bb9f77505a9edd18cf8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 13.1MB
        • SHA256 4ace960984d0937eb3f76652c2134385e261200d48af824b3c209e1703c7ded5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 92.1MB
        • SHA256 eedce89ab4ae415b2a7df77886b17edaeccf6e77ca74f654a7c376e09b0d6c56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 92.1MB
        • SHA256 24dc43781c831ae5bc7a8d1c7513a379603c83f5971466ff3babbdcc1ae56408
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 92.1MB
        • SHA256 391f5f557653fd3149a799940b42c2072fca1db2b29cf8b33767495fae5221e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 92.1MB
        • SHA256 bab487b3ca64b9d9944cfe6644f95f347e8890b7a3a3172cf4438ca6c9f403b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 46.0MB
        • SHA256 73529beefde9f4afdf86700b0a187cb904eae5d3392605b1af0043fc9281dec4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download