Overview

overview

8

Static

static

3

2026-06-28...wk.exe

windows10-2004-x64

8

2026-06-28...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    39s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/06/2026, 23:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-28_3f91b34f34231f3a5f2283e43ca2096d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 29.7MB
  • Sample260628-2383vsgz5k
  • SHA256 04d14c63fc971dc41db6e02b72c58510ab10267638525d28deb161c215c2ba4e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_3f91b34f34231f3a5f2283e43ca2096d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-28_3f91b34f34231f3a5f2283e43ca2096d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3656
  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_3f91b34f34231f3a5f2283e43ca2096d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-28_3f91b34f34231f3a5f2283e43ca2096d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2352

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 30.0MB
        • SHA256 d4e9801937524147b50c1de047f66d3ae00cad3d7afefeae4d819a423506bf8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 59.4MB
        • SHA256 556af7a3b35ad92c7a58032e3f264c938449a7110cf3658f14e3a4d2c9de8eda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 63.5MB
        • SHA256 1e0c3d7b1729eba08400807f23ff71851a6b3b9f6a966203c73c79b9f565a110
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 59.7MB
        • SHA256 38fe2ce5b3f6b13ad289e0cee666fbfa6ca386ba73e62687dbf37830c8c8970f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 31.8MB
        • SHA256 8a9b03697d53c3664221b1135f372582c09727db43a87fdf15a7743eb6d84d7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 59.5MB
        • SHA256 aee1c718bcb3010b343af2e97a58c905c9565475e9b8039f5128de0df2d5c852
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 65.4MB
        • SHA256 b2168d845f045ded798ae86d579d1767321ab5dfe374505d45ffebdac5fd929f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 61.1MB
        • SHA256 d2eacba4154711fda106c26ad2a1811bd7dc8410e89ed6df81476144d633acac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 62.8MB
        • SHA256 49c73dd5f406da772d7a4debf3e2e1240e591efe181fb40c237eed08ae9c8bf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 61.6MB
        • SHA256 25b36321199ea98204b37306d77e4af3a480211ed046e2cecea46a399061e6d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 61.0MB
        • SHA256 47265341276407e3fdae685325227b92e93a67663ee61413528e5e1487cd620b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 61.2MB
        • SHA256 2238b36d490e25717be2960a8231f2a0742710c78f454b5f5c718b2b924a342f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 62.4MB
        • SHA256 d040b61b1cfbed9b43bfe34e86b27b25b99c085da6d61ebb21c24ec42ad158c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 60.8MB
        • SHA256 f9ffe150364ed0a5336ce94ed088d4c064718a3c27a32fb9db1f0c9ec82f5a2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 59.4MB
        • SHA256 466cf6099b974a0db2a3011e7bc2c82149f96ab0d360cd0f82a124183945303b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 59.4MB
        • SHA256 d2ae63ce5a20a15012697c502bdd26df3e0903ad31855942691ef283e2f11ca7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 59.4MB
        • SHA256 5e18018b4265101542881deaddc0f2a9673d3dda254aaa27c9e80446ef237574
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 59.4MB
        • SHA256 22ec9b1aba6bb5382ef549f9058156f9e76eb08f1892799bb4122ff4b9273708
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 59.4MB
        • SHA256 91cc92f1d038cb8bbc7ed92fb73e7ba334f02a1c762c0275776ece28dd36edba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 58.0MB
        • SHA256 20e858b73bcaac8e88cc8fd1b6c5913412dc70647a9773e42e2acd7568803482
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 55.4MB
        • SHA256 61b85596583e765aefcb10c02d43cea1e016ed7cec495dfd57be0030eeeb5b40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 55.2MB
        • SHA256 a3e346647a9b408d0476b6d06d193d54dae3a916669f0da6c2b37e3dd78b252e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 54.8MB
        • SHA256 b9353c3e42c69fe3c3ab64fc213cd2f9050bf0cec14b5d1c5af0ae0a21deb8d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 54.4MB
        • SHA256 a1bc20d448729c4bf05362bbd353996866d6185a995182b2cc9a2dde2339a982
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 54.2MB
        • SHA256 304ffdf1e5db857fb9ef1782b79a89caa22fd1cbd32704989b1dfb5cadb70e42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 54.1MB
        • SHA256 a9f9a83be47de7cb2f0cf00b01cc104f9f5199f6f8a4ec31e8374513d586ff81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 53.9MB
        • SHA256 e662c8b14e958ff550fe6c30d1080980d3eb5a04c4277b25c542e953578178a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 53.8MB
        • SHA256 4e3539b589a12efc8d8008807a04a082ae1dda3cb2d5cc6b603d91f8724e2833
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 51.6MB
        • SHA256 997d1cf996eccdc425a1a20f128e9438cd017def033f443065332b2c4cbe8126
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 53.2MB
        • SHA256 1e7ecf42b20279f026a6adfc00294cc4dc75a0786f68ef266e60ef1b7d9a3345
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 53.2MB
        • SHA256 4a093adc4b9afaa638cf5e32fca7c6606b3bc6f9f9694c18299e719d321ad95d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 52.8MB
        • SHA256 0bd6b2fe7743923c33232253ec6cd5a4016d2d53ecaf9119b21cd07f200fac55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 52.5MB
        • SHA256 30083774c3cc323f961caad881e5f8ea137050860066925200a45f7cfeac04a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 52.6MB
        • SHA256 a2a6335967b450ca45be026ecb3017274485029e626513d6a469d775b3811ae1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 52.1MB
        • SHA256 978485363411933c1500f692cea0bf3f2f7ddc8f0c99089b6e455ae70d0b0168
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 51.8MB
        • SHA256 9b2d8e59f69c101c09894f29fc4c8a766bf93d298d00e3504cd42f0d1068214d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 51.2MB
        • SHA256 f2ea6b695d6a95f519f9e50726f43417ee1dca51e932f0f1ced83fe5fa3ba05f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 50.9MB
        • SHA256 79ad2dc46d7f03fa4382219b8a4a4f319707057e632b27d3f0f16996b540ff5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 59.5MB
        • SHA256 8cdde9e3f8432d01681df62462cdfc15599331d787a00e100ecab497000d3f27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 59.4MB
        • SHA256 9baceab47dc7a23f3942df35055aefe8ef7bececd63edced8aba01a363256c1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 59.4MB
        • SHA256 503776f486e085437845f66c4e100e293797bbe5e5198d1acadc046911019502
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 59.4MB
        • SHA256 6702ffebf35b3b100c6fb3c95dd102502cda1b6c7a297b5ed513618ecc0a58d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2352-38-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3656-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3656-21-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download