Overview

overview

8

Static

static

3

2026-06-30...wk.exe

windows10-2004-x64

8

2026-06-30...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    59s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/06/2026, 22:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-30_56fb3a6c0c9f8b6b7cde444c173e5db9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 32.2MB
  • Sample260630-2ejs3aay2w
  • SHA256 8b77f5341fa03373cab6b7419d8fc8c355818608d19279030e5e7b79a90c7753
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_56fb3a6c0c9f8b6b7cde444c173e5db9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-30_56fb3a6c0c9f8b6b7cde444c173e5db9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4696
  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_56fb3a6c0c9f8b6b7cde444c173e5db9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-30_56fb3a6c0c9f8b6b7cde444c173e5db9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5988
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:1852
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
        PID:4208
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:988
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
          PID:4836

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 32.8MB
              • SHA256 2e637c15cadd634ef13882eb27c5814b3b5eb95b2a98daed97f6720bd8ec56bd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 32.2MB
              • SHA256 8b77f5341fa03373cab6b7419d8fc8c355818608d19279030e5e7b79a90c7753
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 64.7MB
              • SHA256 df15739d39cbd020a7a5019bbdc18cb080b57217b0ef368dbeb218d28c24aa4f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              InspectorOfficeGadget.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
              • Size 64.5MB
              • SHA256 0595defcf2d18915e9d9d895a013854dca6565ba363de167cf063f2e422ca3fe
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 68.5MB
              • SHA256 bdb8c6d26be3d818f4155ab790e48d7c2d9c6fdbd16b83a98d3d0af4a99fb2fb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 64.8MB
              • SHA256 baefd3bbfa540aecec95436777f5ea08b615583b23111fbe04570882abdb6e41
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 66.6MB
              • SHA256 44808c4b3a2dec4f54d5aef20a665e8baca04a58553612cc436e06491b7d6324
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 64.5MB
              • SHA256 aa654a8e3713f51541904aa98ff96bf11fcc7992c300439b4a767d7af64e59f5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
              • Size 38.3MB
              • SHA256 92ee4beea9dee18fb263be371b37cfc0c1077866b5c56a94b4d2bebb5789e8a9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
              • Size 70.5MB
              • SHA256 15c19e25bd6d2b76bf8ae4c6179f4bce14b416c6c9f22f56c5e55741f4514006
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
              • Size 33.9MB
              • SHA256 ea7a23e08e31622e57f4b1fa8bf0d93f14c670b6a894e93f36399e5d07023e73
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 34.5MB
              • SHA256 e63f3b89936bbc05d231f4bbb71cd6f0113d0418b81de928fcc77f5d779ded11
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
              • Size 66.1MB
              • SHA256 13839fdd5ec1930a09ad86d88f6f25717d0fa1db876a5a53df9d2fda0608c812
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome.exe
              • Size 67.5MB
              • SHA256 c12ea1721547ec81c52dbe4aeaf609e502e15377d8686fb9d5813340940c79b9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 64.5MB
              • SHA256 852e16613e727d3bff946270c43bb20987b2d68b2a098a6b0ba5776ec5abe342
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              idlj.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
              • Size 64.5MB
              • SHA256 a82a3853bdffa7a17fdaf67d1cba40ad07366490049a4f2c16da831074db30a2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 64.5MB
              • SHA256 d4cfbc0dfec6862c840b14970b86d0bd7d0c973136befb590e2d9d6a82a5151c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jar.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
              • Size 60.8MB
              • SHA256 29cb64e4ebb7854ed04ff5cfc55020ff0c895e8e36dba794f60d852f130c6eaa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jarsigner.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
              • Size 832KB
              • SHA256 fa8b9cb29a86f59d8f273b148ff27cdaf09d33b15bbfa2790ba1fd0a9b50a372
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java-rmi.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
              • Size 59.8MB
              • SHA256 15dbbf9857c80a3cc045aece275745a0472bf35872211f3d7ae83c2c7969a0c6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
              • Size 55.1MB
              • SHA256 dc2ca4b1c77b35ae572e09cf4c0ce79f0e076c9221845f6e2400d1cd68636d66
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javadoc.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
              • Size 58.8MB
              • SHA256 4418ec87d3373e5fdc4e9e009f29e9e23c3a241f79a495025cd2e906ced7e6e8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javafxpackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
              • Size 49.4MB
              • SHA256 20576e0ec75dad59fed223174ea4f8a2358c378f2b1be38f9004d4741cd5d2fd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javah.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
              • Size 47.6MB
              • SHA256 70960fb13a6e01fbee9973c67e414d3e0e2f7cf6f3b4cba41a9cec0e241ab9d6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javap.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
              • Size 49.2MB
              • SHA256 78a605b6dd288dfef3325d6271c42064603c83fd305f2055f1d4679259cdd13e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javapackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
              • Size 49.6MB
              • SHA256 5c3f63c49de2208498e3d6a721c52614a2dda472c219196077c5d967f94cbb58
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaw.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
              • Size 45.5MB
              • SHA256 740fa1aa089a7263db3c4f99c19ca30387c0a8fd18c282a5ab80ff7a0c26bf84
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaws.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
              • Size 41.9MB
              • SHA256 90664e8f698157c4fdff82a36af2b9569e205b0bb0adef8057cbc294396c8764
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jcmd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
              • Size 40.2MB
              • SHA256 8d5e0fec41fd9cf13dbb6c033aae80101145b3983c817bf2850a8c39b6880f27
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jconsole.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
              • Size 40.0MB
              • SHA256 83c35fb809fab42bf65ecc08d7e134a627b909b42b8c6a65a4bbca56551da5dd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jdb.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
              • Size 39.6MB
              • SHA256 c732ebeea4854a215e27aa1666c5693202ea44d3eff19b5590a61452e91d77db
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jinfo.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
              • Size 38.4MB
              • SHA256 2a61b126879d66371864280003dda6b1020a89d14c755bdb2b1fa4b7951217bf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jjs.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
              • Size 37.8MB
              • SHA256 0f125b99b1eda3f0d3ca05b9648904c9581546ba5db8f04f367a5e6e21c89683
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jps.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
              • Size 37.2MB
              • SHA256 a065690d50a52d89c49bf9d8e779e580ccdcba15c4d8c98b0bd5bc23fb0760bd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jrunscript.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
              • Size 36.9MB
              • SHA256 bc4103fd8c1e1cee74b6eabe0fa6f05e88dd7880c23e4295336e70cf97cf9497
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              keytool.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
              • Size 35.8MB
              • SHA256 c267b6087c9f6ca0bf3aa5dbe5b2b4021bc6f61382862baa8d52cb82ff7e8f4c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              kinit.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
              • Size 35.2MB
              • SHA256 f69ad1944ec2a0c0495387ab3ac5e5ac1d82286a8b097b83347349d5a61a5415
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              schemagen.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
              • Size 32.3MB
              • SHA256 3e315461f75a352807b151c3746f46238f2f62cf75a7206e3c1a0dab58e81495
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 64.6MB
              • SHA256 31b8aff7f5e3340225b3bfee8e7584f29109642c59c9f0b763ba228f6e65e8b3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              createdump.exe
              • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
              • Size 64.5MB
              • SHA256 f2b8e1ee733e7fcef877761982149a8a4bb20e36b3576823cf90aacdfb7f45a3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              createdump.exe
              • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
              • Size 64.5MB
              • SHA256 920c3367b543d68000b881610400494224e10b92929a938be924f1d7bc0f6187
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prep_Activatable Class_Hermes_perf.cache
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
              • Size 595B
              • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/4836-263-0x0000010F81A30000-0x0000010F81A50000-memory.dmp
              Download

              memory/4836-290-0x0000010F81DE0000-0x0000010F81E00000-memory.dmp
              Download

              memory/4836-304-0x0000010F943E0000-0x0000010F94400000-memory.dmp
              Download

              memory/4836-264-0x0000010F84000000-0x0000010F84100000-memory.dmp
              Download

              memory/4836-255-0x0000010F801E0000-0x0000010F802E0000-memory.dmp
              Download