Overview

overview

8

Static

static

3

2026-06-29...wk.exe

windows10-2004-x64

8

2026-06-29...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    33s
  • max time network
    123s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/06/2026, 04:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-29_b11935f78dd1b08ecb5f46c7560ecff3_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 31.0MB
  • Sample260630-fe95csft4l
  • SHA256 8acdc506c6cea85760d069a268260a2e1a90a1d1faa23949b28341346ecdee1d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-29_b11935f78dd1b08ecb5f46c7560ecff3_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-29_b11935f78dd1b08ecb5f46c7560ecff3_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3496
  • C:\Users\Admin\AppData\Local\Temp\2026-06-29_b11935f78dd1b08ecb5f46c7560ecff3_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-29_b11935f78dd1b08ecb5f46c7560ecff3_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1528

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 31.3MB
        • SHA256 3e7d2494cd56c25afab3f8ca2b10a5ba527a53e734631ee43cb8c41334e7acda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 35.1MB
        • SHA256 3840071110908ee44518b3da11238041423d94541f0b19c0623905bb64ec35bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 54.5MB
        • SHA256 f4ed9395c7ba1fab3034b56256459964f73382f414c0aafe0599f95d19054fdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 33.1MB
        • SHA256 df240ef43fa5d00f06deaf0db2f8930cd965ed72c0785924c396ac7290f1df17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 62.1MB
        • SHA256 163e7c584f91e8a6e066e0fbc6b1e54a09cdf705fe710f1cb329b548cb7bf8e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 68.1MB
        • SHA256 9e0f5a0fac43c6543e5f6ebffadab1512ff47fde5d6ea2e1e5eca4928c48407a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 63.7MB
        • SHA256 3ddb8411f57b9e5b81f20c831011226b02e900e6465d7108fc33a8130a6302e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 65.5MB
        • SHA256 bf4db683d9e4cb0e6822f7a0e8e8cab8ad429fecff0f07278135d62e98571fad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 64.3MB
        • SHA256 3364a17d6d747ea3b7749a4a834d8b2e058c062eb8461168a57a17069f1b4038
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 63.9MB
        • SHA256 421eb68926f7f17d92f3dccb1214cc17c7f0a98452ab2c5bfb899f5e9d0cdf29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 62.1MB
        • SHA256 2297bfc1a159dddce8e03faffc68428846fdbbc7be7c66d3208d306064dcdb71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 62.1MB
        • SHA256 3ad32038a0d9e2a85242844966ca23b08bc4f6a8e16a3230a57ca93da1f72470
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 62.1MB
        • SHA256 9ddf8de5bb68da2c1c3a96110c56c4ee31ff7fbe8728036ea5838556cdbc1a0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 62.1MB
        • SHA256 5a07b364dece82b064e0bb4ea52734f294196d30840f4aec49a817304a30fac5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 62.1MB
        • SHA256 b63d058782d0fc45aa81ad1d0e2d80446dd1f31065deb525555ed6abd9d5d82d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 62.1MB
        • SHA256 aec313e339b861faf12a9276e50605da638197be25282a50e79aa132e959ac73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 62.3MB
        • SHA256 3b30cfea4f9e7038d0bfa7a82dcbb158dd4761355735a8d7eb8e8edaabf56b63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 704KB
        • SHA256 e5ac195ed95906c4c7d38e22813edc5f1a0626c9af950926575d44363de6f816
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 960KB
        • SHA256 b6bfa9acdd9417d53631eeb3e32ec0937b3287ab4963d3a18fcb0b1ffe79f4a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 62.1MB
        • SHA256 b2a36245ed38f8dd80015db365ffa06dae77c22e5f7960f013ab393b2e05246a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 61.8MB
        • SHA256 67f0292df5fb49c33ae75f16237170de0ea03efe83b76fe310037ffd93ee233a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 61.0MB
        • SHA256 7a4513e36fc4a1898be5ed795da07f15122d39dfd8f8ed95fc358bcd0ebf91a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 60.2MB
        • SHA256 5f99e98beebcb45158439ef08050d74155d47ddf245eb39823598067de54b44c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 59.5MB
        • SHA256 da440a0935fb4f4d4038adf5c12127dab9e9dbfa80431213b5f8a3123ba9ebf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 59.1MB
        • SHA256 26b17058c3b91f2302e727249ce7e9b7b1223e609e4fa6369ca32d7ed4f01803
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 58.6MB
        • SHA256 e76f48bd24a186e04657bed83a72aedcc704e173574458bd4363fd8e89a5de1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 57.9MB
        • SHA256 d64bf97c43bceb045ffe72dc6825b3d9b9295ed8e2620c7bfd3c080c19130496
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 56.9MB
        • SHA256 244260f4ef82c532555a5e7ea245d812dbf6b08c8c371d765cd3e84a5aa38d01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 56.0MB
        • SHA256 3f77fa3a94f31f5566eafab4d8390f4b77b04caaf66c910c08c7f71d3bee7844
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 55.7MB
        • SHA256 8ee81201614dfc83d3e156a30be25b53c563f7270f79ea7aac70cb6f84de43af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 55.1MB
        • SHA256 f98cebf58ee61bce1cc8a56fb67dad300a6621b7e41454c7aea662864a375b35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 54.6MB
        • SHA256 82aa6fe3350f03325d919edac2ef37004eee9555bdca2399aa5af89567825f6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 54.1MB
        • SHA256 b55b6a2a4aafd66443eb96b5224ef3fa57ab3befca8b9a235eb2042f71209cad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 53.9MB
        • SHA256 a9c8aa3202b55986d30d62785b40cbe84053ac3584a788887aed2e4e57d03f33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 53.8MB
        • SHA256 3f8341e449df00b258e340df3ed6af42e8a7e879d27e0e219619ea8129846845
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 53.6MB
        • SHA256 98479ff7cc68e492d37c6f141ec9f72c8db49eb3dcc3fbeab857352eae377f82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 53.4MB
        • SHA256 90787c1c7f28e0c903c1e4db3441bdd418a3881dcbb5eb764e8b6f82ef9eb9d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 62.2MB
        • SHA256 6aec2bb45ddbb3557420412bdfe2f7e01fb9b2aff124dee4969b5de13eff1a82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 62.1MB
        • SHA256 b7225f4dc4ff24419dad93068c67df399c03b39a764d7080d763b5bde3b566eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 62.1MB
        • SHA256 d5ce84644d10416a1982aa68c9dc44315c354850586f0b1ae075e6b5643e650b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 62.1MB
        • SHA256 ecd5cf688e1b13dfee9f9bdd05ea6e812bc7b9d1cfee77e606d6f409132466cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1528-11-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3496-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3496-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download