Overview

overview

8

Static

static

3

2026-06-27...wk.exe

windows10-2004-x64

8

2026-06-27...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/06/2026, 04:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-27_960fdc67c2fa8263ca58867009448929_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 28.5MB
  • Sample260629-fh1ebsdv21
  • SHA256 b92e43ed54eed10e5bbd0a96964e48c0d35f1334abc961934983a7063798b32d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_960fdc67c2fa8263ca58867009448929_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-27_960fdc67c2fa8263ca58867009448929_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3568
  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_960fdc67c2fa8263ca58867009448929_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-27_960fdc67c2fa8263ca58867009448929_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4744

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 29.2MB
        • SHA256 5b54a12079aa7dc7385d65bdf668e81ddfc28c1453820f7516346aa1a937582c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 57.2MB
        • SHA256 69966cc5283cc798ba598f6b09c14ed64f5d418c0878e43e04750e62271f5087
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 57.0MB
        • SHA256 24aa9b7ac7eef97ecfb61b133db1eeffcf7c5394c433eadb31488db93607853b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 61.1MB
        • SHA256 e9115b7d3617737c03cc38461c26d120aee64d94caf24900b13fd9bfbe1d7b9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 57.3MB
        • SHA256 fda2bd7f7d3a55576aa8feab94ed865917a3f5baa4a9dd9e40714296f83b40af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 59.1MB
        • SHA256 ac2b2ab70ecb5ee94f4577365a82d01c645beeaef00a78db8c2ecc773df1aa58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 57.1MB
        • SHA256 3c23fc99edbeefb5f0b0c3356c22ef85b79615ee503b9904f00b5122490bb408
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ConvertProtect.htm
        • Path C:\Program Files\ConvertProtect.htm
        • Size 58.0MB
        • SHA256 4e54ea6c8cc6e067f0aeb475d49eb2066676eeaecdc3b3583e679036b91da77a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 63.0MB
        • SHA256 ee60ac5c49f3ab976395056db52a213fb8f279757cb87c6508d094049cebf0c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 58.7MB
        • SHA256 bf85c26792f0fc087ff65a84d776e869b9df38f9c7bbf31213263a520f786f30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 60.4MB
        • SHA256 f9f1feaf2d77dba58b867e6a3af3cead1c56115fe1506b6df59b8914c5ed2f48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 59.2MB
        • SHA256 49c6043e79bfd687859395ff6fd0f6c7a7b833ce8c288f5852453c04dfc37056
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 58.6MB
        • SHA256 def491321e520c316fa461b66da88955f95d176e1c5799b06d175dc28812500c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 58.8MB
        • SHA256 6ab7372887a91fbc961206580634488911d997185d4483c06e254239497a6a7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 58.4MB
        • SHA256 2a1d138e5ddc22578395090a9f322a33005e362eff59b0b1f349ff58427279bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 57.0MB
        • SHA256 5a5f71011f614d9b2bc958274a1dcc2d33748812653c77958d7f91c6eb60b949
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 57.0MB
        • SHA256 031f458c9dc7c25d295dd8d7fa89ada6b9826f94cb0089d62e2e9ed6060ab91a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 57.0MB
        • SHA256 c0a0b4e604079bd2968807fa0e4d21da949a97ed9c180b191e010e429f9b5b12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 57.0MB
        • SHA256 9e61c1c876fa99c28aca35ab7b53deccc0dd1595dae43ebb6e1129588fd4b8c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 57.0MB
        • SHA256 a46187c6332abce91b3207bbadf7a68eefe5a57d1615220cbc2eb53a2bd16d53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 57.0MB
        • SHA256 9380e20bdafd1a6a2991d516dde72e6d1cf3ca845ac98d2f1ef37f736d383d87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 57.2MB
        • SHA256 1b673fd7dd42e5117ca09e13536d4a908b44f67d2b3286ed760ca2e12b0a832b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 57.0MB
        • SHA256 feda444cd379e518af72cb98bc56c02d7552421466734171ba9a1412ba0b8f3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 57.0MB
        • SHA256 c633ec7a25c2911a8805cdf0d6750ad2674762ec0dd36b4df1be9a577f864e2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 57.1MB
        • SHA256 fbac9786e7d2589a65335eaffdd49fde2634bae60ad547ef62728c7d64835eea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 28.5MB
        • SHA256 7c766ff9fb700e4d2b58b12d434b0cb60e1f07c608748fb020e4519d41c6598b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 57.1MB
        • SHA256 86f937d2979480227f291d7e2b58426cf5d27ae6a83c9d6313a476e711352069
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 57.2MB
        • SHA256 574594a6781a1981bc1fa95eec28d85084b130559b965d9705fbc1641484c8fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 50.1MB
        • SHA256 e00cf7e22578e79fb7dcbe0688560219f86f4afa944aca204610fc723313c9f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 36.8MB
        • SHA256 aaba7ec02624e5daec9f67be04d75623d2e87c4502b870230dffa2a36dd87119
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 33.4MB
        • SHA256 4e405a7a2ca400d193dad3e27f59fe1a6eb99cb173c0e752fb36d98ef5284b18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 27.2MB
        • SHA256 501901fc66c0ad441f5b24c2ad81b9b467c7bb58e9f32317fe5a28d5643711f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 3.2MB
        • SHA256 84cbccbbd21793b908b151d58c2eb055d186c346b2ba88d836a04b89bcc3ff95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 384KB
        • SHA256 144c4713f378ec54938375c9433afb979bcdaf05350d70c3d422e883e7e60d15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 57.1MB
        • SHA256 1b72f57e597ba580c1f1d1d3d25af66400d461c4792b61620836bcada3541d94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 57.0MB
        • SHA256 53652bc44a87554b4d334493d46ba3a47dbba4150b0e54192b528cabb260d03b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 57.0MB
        • SHA256 6e7c80d99eac5413ba00798969ec831a6f70fe659d9f47d74fa32a33ffdd3d21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 57.0MB
        • SHA256 3a8f885ac9b77f89ddc53095812ecfa76bac99fc8939855d22ac8b2a02774fde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 28.5MB
        • SHA256 b92e43ed54eed10e5bbd0a96964e48c0d35f1334abc961934983a7063798b32d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3568-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3568-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4744-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download