Overview

overview

8

Static

static

3

2026-10-23...wk.exe

windows10-2004-x64

8

2026-10-23...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    16s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/10/2026, 15:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-23_011ab0d96eb5eab7671b02005f2ba550_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 20.7MB
  • Sample261023-s2555sdb68
  • SHA256 f035772447ceca8ea0460f8a5c46aa8f0277ce059216c7192fee303efe6d9ca5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-23_011ab0d96eb5eab7671b02005f2ba550_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-23_011ab0d96eb5eab7671b02005f2ba550_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4904
  • C:\Users\Admin\AppData\Local\Temp\2026-10-23_011ab0d96eb5eab7671b02005f2ba550_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-10-23_011ab0d96eb5eab7671b02005f2ba550_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4576

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 20.7MB
        • SHA256 243453d9b378635a03e6b0988901cb37f16afe6a55724f15c9860ecbfe7b34eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 41.6MB
        • SHA256 1d70762d4ae0b8f298c1be7f5f42c3f352e0a0641f5407024a5f6cefda3f2461
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 41.4MB
        • SHA256 f4e53a24a89e5a010d6c0bc03c2307b88b873db6e00c3f89861a258f0b03f067
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 44.1MB
        • SHA256 7f3dd7e710468f54c684e982ea0f415c85ff55a16a79f9ae8f331c5829aa06bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 22.8MB
        • SHA256 c2c0fbe99dd57e3f09ffe92c29e76872989b3d5a180ea46f3b7604c65b0aee28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 41.4MB
        • SHA256 e95c15b07b521d9deed7f1190d274b9f63a16d2b479dc4bd18ce67a657e47aa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 42.6MB
        • SHA256 368368596ccca0b89a53d3f72d3ac3b84ac22d0c8eae2e7bb49f5036f4eb381b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 43.2MB
        • SHA256 3ca5cd5e6715bf85d2430831b5f32cf03444f0e0843af0b823b01bcc0ed7b7a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 22.3MB
        • SHA256 988f3897d750d3823375e37885d8583a5ed800d92425d8f6bd91dd436a78ec7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 20.7MB
        • SHA256 f035772447ceca8ea0460f8a5c46aa8f0277ce059216c7192fee303efe6d9ca5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 38.7MB
        • SHA256 68530ab2a989700f577c2667da8ac074c3329ffb38353a638b5b460584388944
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 40.5MB
        • SHA256 f33042076aa3bde88957d23d90bfe4bdd177c243d9a071820851c8c6635c75b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 39.9MB
        • SHA256 1748aa781448f0ed5355e093379b951b2fc2f0b24be3d5600882d062d24ccfad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 36.6MB
        • SHA256 feffdfe12e95592dc53bdf4115f66e4771c07d02e33ec0ef5fc4da8231c69cea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 39.8MB
        • SHA256 a5eda1b102f5316706531973453fcaf0c6bf4afe2dc92da82a176a7668fc4a2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 38.6MB
        • SHA256 dc74abc5eca0e32f98a815e4f4f0b3765fc9c399bccab07d6c36c35a025dfcc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 39.0MB
        • SHA256 1a747a3ff4e36541634cc6520c63ea08116b6db326c5f52c22e3197165753d69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 38.9MB
        • SHA256 216fcc570b9a21b58b813a54a35cbcb4502ece9fde91b5cc8d40da2872eded2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 37.1MB
        • SHA256 6918368b7eb5b388a5d11b79fd3d8f6678b481a80bd6b37db4344f30a7c4ac69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 37.2MB
        • SHA256 7d23560e3ea66154507b3d2325d479137f75a0fce393e60b4446d11d29407241
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 38.9MB
        • SHA256 32607ba59d70de691edb9eb27571b8a315039da298b78e1b47a2099b73b5a3ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 36.9MB
        • SHA256 906dbe7b7753bff279438e4549945a90a3e65d0af93c2b2b819411a513ee2f26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 36.3MB
        • SHA256 52684d795cc22c207caaa213df405b730d78150960e7d54a57cc4d5b92720e0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 36.2MB
        • SHA256 d854f79cf496a6b3a76c07952719923c4b0aac3f78697cf0488123c3f0bc8a4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 37.3MB
        • SHA256 4587a28d5e69a379609a7ba8b752cc2193b0d7e50d30968ac021301984e592e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 33.1MB
        • SHA256 9ac5b07b10490bc027c6d27f814a06a45f3c2ca8b529ec59e4d0b463f00341f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 32.6MB
        • SHA256 494911f07a1ff935f01e158464f2b7bf2bb23fdb463ab1386e5880988350491f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 35.6MB
        • SHA256 6a3a2a240dc84a0511f6d17c187b30220cc91d4f92ef7696c519f2b08f44ad58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 35.9MB
        • SHA256 f293abf665b2652090a6afa971532cc7f1eb2058e618ad39c31fbda63f295c95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 35.5MB
        • SHA256 f18d13d8cc02cc37b1b59344c678a92dc23ca0618238154872c2013379d495d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 35.4MB
        • SHA256 ceb3a639147b8bdc202dd21625fde6cc5baed2d61d0292e88bd527a11f81cf1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 14.8MB
        • SHA256 cf0be1165cb3b8012aeef8ca0e88d6c6c27d31affc627796c0fdee9acc9db16b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 32.7MB
        • SHA256 0db040651191cfc54b3b7b3541acf53c0f094c9b3b60f468765fd53c1ccc8a08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 35.8MB
        • SHA256 ddbefef7336a7b9150e9e1a6a6e4322750bf64f5de6b40bb3f41e308fe818aee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 33.6MB
        • SHA256 dfe0bfe4f87ea5e7876f19d26a4d182045649bfbc07ff33b8eb97496a968fa2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 36.4MB
        • SHA256 3d7f789f59e9bee2dc47bb2828b232730692f42fc506bd7aaf367ebed256c75d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 32.8MB
        • SHA256 2f3c9ed9d58dbdcdcc3611920d026f642eb8008097a815b6094fef69e2e0e484
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 35.0MB
        • SHA256 c7d8f4258cd5bed330c7b897f6ebc610546fb4a811faecf209ca7beb37afe2e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 36.9MB
        • SHA256 7d76d01ef89926fcaf15adc450838c340f1b0addd13c3b10c851c9ebe614ee22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 34.9MB
        • SHA256 f08a78e808baf781d40d443d7c45fb0844748eb17968d7faf18ca53e605314f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 32.6MB
        • SHA256 9267a0b0f9e72b88b9b028b634c015fa325cb89bf013b94586461ecfee1752ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 35.6MB
        • SHA256 959d4f6211143144a51aefe6b4e913b9cd5d538a171311fd80bc7ca47a9804ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 33.0MB
        • SHA256 4081dd5192071d5b983bf0689814157531567e2e0e7e94bee4f5cf56a312112f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 34.7MB
        • SHA256 81e6c79a7a498719e14a837907f8887892804ef679ba78c2dbc969cd015aee46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 34.8MB
        • SHA256 423fa95c51770d86359da60cd00eaacff1a4567991355ee2c3b552ac39f21934
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 20.7MB
        • SHA256 fedcdf176e353ec4c172ded5da84a02119b38872bbfcb6089634858c9e305220
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 20.9MB
        • SHA256 ab92c1ec82738ed92ef7916aca43d177fc6619ab49676b366097229dd855bfa6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 41.5MB
        • SHA256 10b2a53f90ef65c392dd69654e3712dc88fd3b7b677a8469adda174cd6d74751
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 41.4MB
        • SHA256 9c5c0d21427997a44b6b5e8a8cad44284b4075442bbf2214588c899e138f040d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download