Overview

overview

8

Static

static

3

2026-06-27...wk.exe

windows10-2004-x64

8

2026-06-27...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    67s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 09:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-27_27a6c8171959244bf7edcf6e66e47e69_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 34.6MB
  • Sample260629-k2d3nahw7x
  • SHA256 7346956a488ee3accbe7716d3b73054aac4a7fcc110fa5625510cd41e39268ad
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_27a6c8171959244bf7edcf6e66e47e69_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-27_27a6c8171959244bf7edcf6e66e47e69_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2084
  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_27a6c8171959244bf7edcf6e66e47e69_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-27_27a6c8171959244bf7edcf6e66e47e69_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5968
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:1676
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
          PID:3756
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:2800
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
            PID:4928

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                IntegratedOffice.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                • Size 38.7MB
                • SHA256 b40f2ad28ac2ee9d0f8ba975a1e0c7a6dcbc15912d548a528363e3a4ae9e6ca7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MavInject32.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                • Size 69.6MB
                • SHA256 6d08986c4bc29d21ba5acc305ebbd21d49998043d2b81f97545019144d2f9b53
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appvcleaner.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                • Size 36.7MB
                • SHA256 c66cba5a0821a56bb542b5bb5b06e23bbac8b67a8522a751bbe5db88b0ce8e0b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSTOInstaller.exe
                • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                • Size 69.3MB
                • SHA256 bf24443731b3a8319eeeb0b1bb16c534e726061c14e569c0793e57b1b06dbc97
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrmstp.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                • Size 75.3MB
                • SHA256 9e21c771e1dc432ea0f69f350acfcd42382a9d362c9acc28bfa9e8c7dcdfcc1d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                setup.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                • Size 40.7MB
                • SHA256 87d57ba13f4f4872b0909156ca4b7426161d6245fdc04c23bf577234e2cdfdca
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_pwa_launcher.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                • Size 36.3MB
                • SHA256 9a99abbb4b704d04cd7d6717345f1ef912d11e9ba820127318015fee3410ac3b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevated_tracing_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                • Size 34.6MB
                • SHA256 7346956a488ee3accbe7716d3b73054aac4a7fcc110fa5625510cd41e39268ad
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevation_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                • Size 36.9MB
                • SHA256 2d2d007d25bfafa0e8c3d9d821fbf2d8c8cbb5bf3bc01e618248e8c6a798d6bc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                notification_helper.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                • Size 70.8MB
                • SHA256 32276718f5c5ed107208329c4101679c6ddf14b2cd32a67f005e90d912b5a1ae
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                os_update_handler.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                • Size 71.1MB
                • SHA256 ca63f9dd130e1d60cd0c0a90044b30c908ac51d52d9b1175cce684054fae55be
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome.exe
                • Path C:\Program Files\Google\Chrome\Application\chrome.exe
                • Size 72.3MB
                • SHA256 7ceb1ce64cc7edc33f1a813c37503d7db7aee8270a0550fd0d6f839172e5c55a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_proxy.exe
                • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                • Size 70.6MB
                • SHA256 09b641253a198e0b39d408e86bc30758c29a17bd1426c62d719f112e2c4a3b58
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appletviewer.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                • Size 69.2MB
                • SHA256 3d7ee0096efacee12e6a1f56461b89c8d869546369b27be396ee7ff6473e5c34
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                extcheck.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                • Size 68.3MB
                • SHA256 cd4a9152a8b49633f04ff7181e2bb626db3c5ecead382a168bcd5c8afcbbadfc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                idlj.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                • Size 65.9MB
                • SHA256 90e32f8b405f071bb2793c2f1e77791a7a9b5a6840f3f45b89386304ba748487
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jabswitch.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                • Size 62.9MB
                • SHA256 722813ca5f4b9a032692693b9006de07e7cbccebb58cc44bad7f47bc6604c97a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jar.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                • Size 59.2MB
                • SHA256 6e0e21ef663d3aac4c91b0846976dd4b651cd88f2583f776a58ebc25f5fc1176
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jarsigner.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
                • Size 60.6MB
                • SHA256 82c852ed21107affdafbad1067c62cc2aef3b08283a23729111fdaa169df3140
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java-rmi.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
                • Size 58.1MB
                • SHA256 ae90bbf9f0d78b2959e4ea0574d7136933ceb94d05a1f3dc57349c76c8be03d7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                • Size 59.2MB
                • SHA256 9db198308d8628713240ad229d77e83b77c041c4234f03f307b754140ca520e9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javac.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                • Size 60.1MB
                • SHA256 8f367506159de09c9170f78126be2d3b3116f9e2582567b31c99488d9d225eec
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javadoc.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                • Size 56.7MB
                • SHA256 644bdaa2235d8164c9e2a51bcfa41b5ddda2bb52aa534c207b577db52d02326d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javafxpackager.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
                • Size 58.1MB
                • SHA256 4d787b62012588cdbe512e30d0e204b8079674829d3325b8dda921ce37699f44
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javah.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
                • Size 41.9MB
                • SHA256 fc3fa76a27f9f20d72611e877448ddf0a8f16237d0c22c693f13f99f6678116c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javap.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
                • Size 57.1MB
                • SHA256 7130c89843dac9fccd00808f532a42877ca7f8649c7999b16cf964dbe0180b22
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javapackager.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
                • Size 54.3MB
                • SHA256 ac74469962548ac57bb1317800a5236e91cb9b0582db40cd8b285b2b13602cc6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaw.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
                • Size 52.9MB
                • SHA256 20b97ab41d8f6aa17f4d2075654ff7e6df4337378f350dfd48d4e4875dab893f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaws.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
                • Size 50.2MB
                • SHA256 91a34aba569922e280cf8baaf2c9e1dce3ff1bc1ba8b29726a29b7d82e6a8b63
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jcmd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
                • Size 48.8MB
                • SHA256 61c8d890c641848f96a5b6f43ae3433c11b3ad46e262244e4bfa491eebb65b8c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jconsole.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
                • Size 49.4MB
                • SHA256 a9444c1176156601677d7e02ca225e6d8133c24ff951c1b1398f71b84fdc208b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jdb.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
                • Size 48.1MB
                • SHA256 5e24a5357516e3d6aefed96dfc800c73eb4c1a5ac740539712eb6c8a6691f1df
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jdeps.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
                • Size 46.2MB
                • SHA256 fe9598d25d03e507cca317808d55ef07ab4c40b9266e5f4d3d6bf2b0b9165da2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jhat.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
                • Size 44.8MB
                • SHA256 3dc768a30f33b8c7f3286a9e96d683a66d05e2f442c4759c0c67dcaa8e4964f3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jinfo.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
                • Size 47.9MB
                • SHA256 a2bc422350229e9bc10bd73ceb9c7084a50d08794ef913491ec18e6df24ed0d1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jmap.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
                • Size 43.0MB
                • SHA256 21cf7da88d7f0ce7d06279ad9be5defe3612885ed002c2b9a41daafa120a2614
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jps.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
                • Size 45.7MB
                • SHA256 38fc1fc4d159e1f10449efc2b1003e974c07f03466bc76a6e44d97a2fe8a242a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jrunscript.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
                • Size 40.8MB
                • SHA256 6c2e663fc00ea6ab0e5eaa72a383f073a1bd39455d68f81f4e8427a19fe27b8e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jsadebugd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
                • Size 18.4MB
                • SHA256 fa54500f396cecf565e00a65faf1e56666553b99c9192ad1d4e25827a20fa4e2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jstack.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
                • Size 17.4MB
                • SHA256 52a41b3df0b93f84f37ae2e3bcead96e66afbdadc43195f2345a8442247f70c8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jstat.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
                • Size 16.6MB
                • SHA256 da0b39226a19b1893fd94ecc3804df1e2f5860ea7e188e46cfd4de1578b4ef84
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dotnet.exe
                • Path C:\Program Files\dotnet\dotnet.exe
                • Size 69.4MB
                • SHA256 b2ad7f449da30929673600103117962e59ebdd3cae680307072e5535f2cfb3db
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                createdump.exe
                • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
                • Size 69.3MB
                • SHA256 9fbfbce5d6de7f33b2553d4027301c64d74833a7c0c611143b88b0515027da30
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                createdump.exe
                • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
                • Size 69.3MB
                • SHA256 f27b82131e9229a892fe152066902c0f741094ff14dfd7656b84ddced66f576f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                createdump.exe
                • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
                • Size 69.3MB
                • SHA256 12b7f2a3e26d159f70fa1758b95c5f8698bfbd663a7ed06e36dbf4f5001c9bb5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prep_Activatable Class_Hermes_perf.cache
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                • Size 599B
                • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/4928-297-0x000001CA001E0000-0x000001CA002E0000-memory.dmp
                Download

                memory/4928-332-0x000001CA01E50000-0x000001CA01F50000-memory.dmp
                Download

                memory/4928-331-0x000001CA01900000-0x000001CA01920000-memory.dmp
                Download

                memory/4928-333-0x000001CA01C80000-0x000001CA01CA0000-memory.dmp
                Download

                memory/4928-343-0x000001CA140C0000-0x000001CA140E0000-memory.dmp
                Download