Overview

overview

8

Static

static

3

2026-06-26...wk.exe

windows10-2004-x64

2026-06-26...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    46s
  • max time network
    123s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 17:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-26_27abdb9ea4ff811efa2bd89405d06d80_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 37.2MB
  • Sample260629-vzelhsct4l
  • SHA256 b90354bc1cfcd9bfa30e57c6b10350aa3d7b2411d1081c39c487a73b9dc9d5f9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-26_27abdb9ea4ff811efa2bd89405d06d80_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-26_27abdb9ea4ff811efa2bd89405d06d80_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3436
  • C:\Users\Admin\AppData\Local\Temp\2026-06-26_27abdb9ea4ff811efa2bd89405d06d80_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-26_27abdb9ea4ff811efa2bd89405d06d80_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4548

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 37.2MB
        • SHA256 b90354bc1cfcd9bfa30e57c6b10350aa3d7b2411d1081c39c487a73b9dc9d5f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 74.6MB
        • SHA256 b9c582d8c233187b4a534b382cdac561161193035d09347da72d3e25c24c39cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 74.4MB
        • SHA256 4bfa7ad270ac3bb78946d5f4afa03c55da39b97280e909576a6d80462b44f6a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 78.5MB
        • SHA256 6159691f87fe6c7c1420d1fbd90952399114cdf650b68562034348f3ff51e45b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 74.7MB
        • SHA256 ec23c1db126dafe5a0a3dfba680eb39555693337f8a37e73d7951a111f527dd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 74.5MB
        • SHA256 8e73faa000792ecf8c3d11d62dc2fb1c7a4edce71e55b618062c7f73fafc549d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 72.6MB
        • SHA256 802843dfc3f2d10d219551795b2104892b46c2d421dfd3842906d8cfa6c4d9b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 74.2MB
        • SHA256 d3611452bfdbe7dcabdaa22a8090f7ecf83fc6fb4e9bb1318e0fcc6bd3065610
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 76.1MB
        • SHA256 5d51341cc679101984698795db8ef9533c6f9c68fcc1e55983e6a47810c632ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 73.4MB
        • SHA256 6bb63405541eadceb0b20ff2cea9716a8f8fbecf8529bec24580624dab4e7adf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 74.1MB
        • SHA256 be7d4ec1442e2a0b8ba0a7749a6c7bd565a1ed0b11cc58624f840c635c8c4693
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 71.2MB
        • SHA256 61cb874b3ce22613d4ef5d48187a5f4fd3d217b7a95a46393739ebb87e1f6e64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 70.6MB
        • SHA256 de6e165d42d0cabec70775bfc49f87790afd2a4bf42b9e786064c6801002684c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 70.2MB
        • SHA256 74d5bdc80bcbd556d0c285d4fa8e8f9351a4501fdde6e5263b62cd81f8db9cb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 66.9MB
        • SHA256 758af4140ae1afedad3ed310f545dbe0b9740892605c24747a463189f6bdd122
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 65.8MB
        • SHA256 9bc002ec8ab8619bf313353a8ab91a587e7d9750cca19c59dd897c0852fb8d11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 64.2MB
        • SHA256 03f8f7dfa2ebf9b4c7ea9c03d5132a0d42835675d45a2f6a6e7cbfb3c1cd3321
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 62.9MB
        • SHA256 ebc3f94f8d2378af2454d268a059ad74c2f73658fffb83a3fd7f3e3a02bc7258
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 62.6MB
        • SHA256 1d917a89723a0c6d9210c2c7d987ab989aaff23aeed2f2e1dd3ea18dfdfec3d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 62.3MB
        • SHA256 1492b49fe7e2b8c335435ae33d31e27b0a3260a746cf04c5218a1c5d75d5627d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 60.8MB
        • SHA256 1ebb7ef6df831e71012e2275cfea0ee56bc9b8262fc9aa2c7ddf5def150aff9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 60.9MB
        • SHA256 fbf3a379686877207dbd2fbad1d71727a33a1fe610a0f6d3ad39742e2a2a4934
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 59.9MB
        • SHA256 fd546c2cf86b2577c44403856435394c2b7d83fd484845866ad5911846cd6916
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 58.2MB
        • SHA256 ae298152bb0efb988bb9878ddf6815c851978ac4536634e540e4ee8e266e5bb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 57.5MB
        • SHA256 ceca2192018892aaf5318694a06f253fdbaf90d47635090b9bac8e7af8e6ad57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 56.2MB
        • SHA256 afe2221321968bfbae6c81888002c6c09173c5012985788002dfd58bfba08638
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 67.9MB
        • SHA256 e6e680e3a93205bf0fdf75a37e3bf7f83bc55bac3803e5a495cfeb83daa71606
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 66.8MB
        • SHA256 90e9dce74ff745975651ed885cedaf18c10b19ec33ba4c5cd9bbb07cef719a45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 37.2MB
        • SHA256 a871b9e8ba9c7d0e3a0437ba10a4bbe58665df67157d5973753f78a81fc26714
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 4.6MB
        • SHA256 3398d44e8d121a52fbab7f4e8d6c3f4113d4207ea5a39cf0fcf892c703ad4414
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 4.2MB
        • SHA256 1393e177eeaaa9d4ca5d6b50058aa473d83ff26c000a455c2e1cdd715ab5bf31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 3.6MB
        • SHA256 2286484b7aa20d80caf37c25a3cfc33c0c3b26e507c0d573cfab0e3469a47622
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 2.9MB
        • SHA256 54d078af82ca5e62afcd001eb12cf9465cb4b10717d0b470addbff5e2985f70c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 2.1MB
        • SHA256 613db9256be45405fead5e605609e07575b4588ce21327147e46aa7c2c8172c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 1024KB
        • SHA256 c592ee42474c6ef37f2d13f471176afbaa817da1ad48fae98f50628be63935e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 384KB
        • SHA256 3e4e65210d0ce663e458df3dc7915e7345a65463edc2c4781b0feb1a0cd3389a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 64KB
        • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 74.5MB
        • SHA256 06918ce78c0adfb4dc03df74a6736e52ffd30975a04813410e83d3a756c02a6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 74.4MB
        • SHA256 dd4995b4f7b646900f6b993fb7d2a2cc7e85a6d783a32e67d45dba7d447a6d43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 74.4MB
        • SHA256 39bc3a977733418d677e84c1503594199db962c2f7ba41d0834a71153713c155
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download