Overview

overview

8

Static

static

3

2026-06-28...wk.exe

windows10-2004-x64

8

2026-06-28...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    31s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/06/2026, 22:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-28_5b0052a035957f1320b84423346c8d4d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 28.7MB
  • Sample260628-2bls9ags6p
  • SHA256 d9794efd0dea9aa4c630ce09469eea06bad890bb67622afe0ec1445184844505
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_5b0052a035957f1320b84423346c8d4d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-28_5b0052a035957f1320b84423346c8d4d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4996
  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_5b0052a035957f1320b84423346c8d4d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-28_5b0052a035957f1320b84423346c8d4d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:256

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 28.8MB
        • SHA256 d95dcafade8821167eb29b5540824219c7ad8cae03cee3bb12b293dac31db602
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 32.8MB
        • SHA256 c8d8c89434cf0ea23b5ad4f2447d119082c77bc2af1f2c45ce645a1b0f1cdc85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 30.8MB
        • SHA256 eb217e977c6eedb9111a4036460a1f59a5bf17af7c3611ba1cebe0165f070f15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 57.5MB
        • SHA256 e0405e616fc77cb4b990eb0454248be9a7e9e46bb6c32d33c56e0bd2961f3fb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 57.2MB
        • SHA256 9927d06e8ce5119d1e2c2daf9dfede00d0c0378d4631d0daafc9995220300012
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 59.1MB
        • SHA256 42b5ca2559f5186384b2c92d6dee0d340fbd6202bb499a03808f0ed6158a18ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 57.1MB
        • SHA256 7cf91c5188dd4d5ed6c85c1ebe2b942c8538c461195cbcb8292fd08d9666eb25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 57.4MB
        • SHA256 34a15cb86298e04dc773c2767a3f8479d707bfa0e0f3b719d13dd5c5a2f22dcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 55.3MB
        • SHA256 c51a4a5b3e34a0b3ed5e9a6a1033fe9ffe768018825331c2034384b4ae47020c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 55.9MB
        • SHA256 a62f738ccd9aef49d204c37e7bb2b825d900d9d42d68c5d076cf962376f578c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 28.7MB
        • SHA256 df5a4971ea165d2b26eeca3415a4417829b5ae389c32462417d8d6b7984be4f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 54.3MB
        • SHA256 ba173eb04e23df880db8d530290844d7e563c29b1bc9708a0ee0b89d2f79c20d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 53.5MB
        • SHA256 29f502c6044d80260f6cfd13b6b37c0cfc659445092e44300bcef4cdf209c15f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 53.4MB
        • SHA256 3998cf6aa580a78ccb3ef9817958e3981424523fe435427d9ad4cd1e3783e860
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 50.8MB
        • SHA256 c9265cac8ca6158ad046e829ce3a35d85d4e8b2ebde524e4ec887d9bc6f82935
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 49.5MB
        • SHA256 91045135749628c7aefcf20ca9ffda941670a7886c654428d76d3627eba832d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 49.6MB
        • SHA256 1b46e26f678fcb27ed7ad3983b234c57b540e0f5e7a6ece87ed5178970c86d1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 48.9MB
        • SHA256 7c8b43265a802af542b3147d6db575e5e20bc718be92d0b12885b22d4744fa55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 48.5MB
        • SHA256 38d1d5d712254d2ef7b914bbd7740c2047f39ee7425de83153299e0ce0f3e09d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 49.1MB
        • SHA256 fb14cd3bad6bebf783b6a3605862efd8af921bd5d9a4fa8e65889b79f2f57bae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 48.0MB
        • SHA256 8d3740fec3a6b0dd309a4b4411546ee40a1ef32257be3ffe32c7d5955c5c98f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 49.1MB
        • SHA256 016b65ad892f12794b680095ef7f61ce53784783c84af89049c346b0a83b3f81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 47.4MB
        • SHA256 e81165916112b4d60cd826340349d0786be9798bda3b659b4e5934511f0b5448
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 48.4MB
        • SHA256 313870c413899d1a430af836ac88a54f3c80e9180ffe00e298c365cb13d5d922
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 47.5MB
        • SHA256 58b4e13d22a49ccbba034d8083d533e70001c4b4f314d6380da075bebaabdac1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 47.8MB
        • SHA256 5f77142e55894e752a7401e67e8ccda0329d1e557b3fd4f774c769351b6c49f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 47.2MB
        • SHA256 85efacda32a5146a2ad3b67920793acfca2f8f5085d705232ecab0d7b34e7b2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 45.1MB
        • SHA256 a0d5254203fb7fd6920536d81591348ea1d95063da5aa416760c752083712e8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 43.4MB
        • SHA256 986198634d398350ef29e0a1a6a71a729da2c1831a162add2ebbddf03a860651
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 43.1MB
        • SHA256 14da7347096810178c64664703c3738c596aa2d1c57bbb446628813d1ec6a249
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 42.4MB
        • SHA256 7a7c89de8eca0d58b43374f0a22fa10d8c09236416480749551ea295adbaf902
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 42.9MB
        • SHA256 b1bd1f826aac81592c555d4aaf959b2b1297cdf83713232af53d23223fd8a97f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 43.1MB
        • SHA256 05dbde54e6e7acf1f942fed6e01f24aed90c40f8a38c7345ff5fe7d383544d51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 41.6MB
        • SHA256 3e3ce4b2edc09e85a93ecde88182e5b014f38979b13356d81c2b44ef9672eee6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 42.6MB
        • SHA256 8c93ee57b984cf63fb3024bbab0e0606c55e6e3e213474fc718ad179e4ecce2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 42.1MB
        • SHA256 f6f4a7108185e5ecf1646b50707709a05fcec3b41baa87f8b08045b05312651e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 42.2MB
        • SHA256 32a40c7872d45ee71358fdbda6eafc496372d2ea1c911ae4b6a0bd5349694702
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 40.4MB
        • SHA256 bbc31631692deb9b9a9789f0298d86b2f2a0f10b48666aa5ec2de92ba6d37b4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 38.4MB
        • SHA256 ef43b886ce534f6b3a814c64802b212121bf60a95cfda7318f57d3fa2b216e9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 38.9MB
        • SHA256 2891bbee0f5dd2d3b4c89940728f5b05258f1c2e17d842720520bbc11de9027e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 39.1MB
        • SHA256 8aa47714eb47862448d6d0d67f84cc3875cf5f7a78ef6119c52a6c6620757c75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 57.5MB
        • SHA256 d528e0160c6922a0bacda931fd968850651838cbb38a9c6f1e175f78bc5e5735
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/256-22-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4996-11-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4996-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download