Overview

overview

8

Static

static

3

2026-08-21...wk.exe

windows10-2004-x64

8

2026-08-21...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    52s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 16:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_3ef97295d2d2db07a9c87aaef9a63b90_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 46.0MB
  • Sample260822-tpaddafe72
  • SHA256 73529beefde9f4afdf86700b0a187cb904eae5d3392605b1af0043fc9281dec4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_3ef97295d2d2db07a9c87aaef9a63b90_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_3ef97295d2d2db07a9c87aaef9a63b90_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1084
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_3ef97295d2d2db07a9c87aaef9a63b90_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_3ef97295d2d2db07a9c87aaef9a63b90_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:996

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 46.0MB
        • SHA256 6223a37d963696f4f29ca21ca5221b8b1d33a08b2580032c393ae46e2f045dce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 91.1MB
        • SHA256 7cbdb361a801d58fb0dd5b4ac44c9bef8105865913690c2805017365d8ebe780
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 46.0MB
        • SHA256 73529beefde9f4afdf86700b0a187cb904eae5d3392605b1af0043fc9281dec4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 81.4MB
        • SHA256 f5f8e8fc69054fed823a4c293cdb0bc9072facf936135449e737e3d83ba15297
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 77.6MB
        • SHA256 866a5804e72b7006ec8b36c6b9248a15ebf90523537f8ac256135f047ea5404c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 72.7MB
        • SHA256 4d2c53567959bde22e84a18e8b1458653dc3181d3a889ede080a5605c20e3922
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 72.3MB
        • SHA256 2829c1f3ce39723f528bd456bd63e918d4a0c3c8e569c66baa9cef70cb695adb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 65.0MB
        • SHA256 b3edc30645460ea1edc0d451733df518a382c6dd450b3eb82e812e349d5bb839
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 63.0MB
        • SHA256 d8f7cd0d7566d597c344ff635619f69d609ca911d7f64123058027ea96ff4193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 64.1MB
        • SHA256 3e27f2ebde0bc3d634dc3ac5f5a5becb7481358893573ad0538dc0ee07f06bab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 63.7MB
        • SHA256 4b266153b9d8e576fc47acf0f9e6ef68caddda2576fa902a95d2820dc648a257
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 61.3MB
        • SHA256 f6ca5663805698137951884fd199ddfd03dcd2bd7bafa5331ae29fd1862f8027
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 60.4MB
        • SHA256 1237d4c431226d7b0ffbf3c7734c267ec2f9479765ca367dde546774870deb54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 59.4MB
        • SHA256 f72eeff27bee336eeeac1255fe95020a1e100a847a1c9f367b51cb82bc135256
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 58.7MB
        • SHA256 219034bfc9f60433a3f87c35d250627195b518889544c5361be7958b3029029b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 58.5MB
        • SHA256 311746d8113618a642f005b1010378d5703d07feb6c913d976a4b35177bc5531
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 58.1MB
        • SHA256 153320c78620a32ad528c9c2dcfa0fbc6ab86d823ab9f877e7bf83e44f91c9f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 57.5MB
        • SHA256 ca89bc410d38660eb274202ebccbfb585589f602151682f42dab09df58e651ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 57.2MB
        • SHA256 4b28579085439b422ca99e59ed5a20a9afaf3fb3c20091025225ccd5e240ee38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 56.8MB
        • SHA256 43752d99df5597eee75d02d07e0950fbdec8fac5bd82600c636767756ea672a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 54.4MB
        • SHA256 bede9a364cc4238fd465e3ca47517864dec1226959d49343d7cd39b95932169f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 53.9MB
        • SHA256 1b9b6a4a8510c070e8fa105db6648ab6ef1b119e356010fe5b86cf509105eda3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 52.6MB
        • SHA256 9a732407de4fc0bdbe2915e1695a07e90a766720115f275b7c40ebc26c3c9022
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 50.8MB
        • SHA256 1bcfe9218429206509c985cb6bbc5706b8c207a9a0ef51817db36c3637c6ed23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 48.8MB
        • SHA256 5ec94885875066200fe5db4e93afbdc400f57c1ae7094e2e3b7f19a0636ace39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 48.2MB
        • SHA256 c726e6742a7479a465e8424e76ee310ac995108d716eebc960a0b216c59a9a36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 46.1MB
        • SHA256 4d7413e0cb96a8eff2bb245e6d99fa6327233d8a6b8e645bedeca812c3063565
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 44.4MB
        • SHA256 dd41fa280388ef62aa5492e3f42858777dbb7e9bf2656417659fbdfd6ea556ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 40.6MB
        • SHA256 c402988bd2c3477763726e12dc6a0035d29240b72670adc764e72a54066b52ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 40.1MB
        • SHA256 8ba03434f651b33acb3e9dfc775825074b08d76e1299dd9ebcfd66d42ad2d1f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 39.5MB
        • SHA256 92b19c710798c761e1ecea210982c2225a1295d2bb6f398de58a4e879715fc17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 38.7MB
        • SHA256 008fee99a4247d68387d9cf294ce12831b432f77535d839ee500b4dea30eb22c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 82.9MB
        • SHA256 4df95d0e739f3a4cbf4ca03d05af2d76fa86bda9156e1ebd05e9aeb13a3a089f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 82.0MB
        • SHA256 ad793e6ac6fd4a4a2836f46e5e820dd2aa21e634240c9c7b3833dad331ab6a57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 77.1MB
        • SHA256 07ad0bf43e0f6274a5af8ec4a673fe4fd0b113cab486d0aafc8ecfc260f4e15e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 76.6MB
        • SHA256 f41099007ab5eea7178fc5e5f99c55a688bed7e4b54297efe661445e542720b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download