Analysis
- max time kernel
7s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
03/07/2026, 18:00
General
- Target 2026-07-03_167d553cbff1ccddb407bccc7fe48ae3_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
- Size 20.0MB
- Sample260703-wlcensav9m
- SHA256 06eece693f599240c9f8b78d428d18783b44d95b42314a71573504824ae7a879
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_167d553cbff1ccddb407bccc7fe48ae3_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_167d553cbff1ccddb407bccc7fe48ae3_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_167d553cbff1ccddb407bccc7fe48ae3_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exeC:\Users\Admin\AppData\Local\Temp/2026-07-03_167d553cbff1ccddb407bccc7fe48ae3_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
7z.exe
7zFM.exe
7zG.exe
Uninstall.exe
AppVShNotify.exe
InspectorOfficeGadget.exe
IntegratedOffice.exe
OfficeC2RClient.exe
appvcleaner.exe
appvcleaner.exe
chrmstp.exe
setup.exe
chrome_pwa_launcher.exe
os_update_handler.exe
appletviewer.exe
extcheck.exe
jabswitch.exe
jar.exe
java-rmi.exe
java.exe
javac.exe
javadoc.exe
javafxpackager.exe
javah.exe
javap.exe
javapackager.exe
javaw.exe
javaws.exe
jcmd.exe
jconsole.exe
jdb.exe
jdeps.exe
jhat.exe
jjs.exe
jps.exe
jrunscript.exe
jstack.exe
jstat.exe
jstatd.exe
keytool.exe
kinit.exe
klist.exe
ktab.exe
native2ascii.exe
orbd.exe
pack200.exe
policytool.exe
rmic.exe
rmid.exe
dotnet.exe
createdump.exe
prep_Activatable Class_Hermes_perf.cache
memory/2800-26-0x00000215001E0000-0x00000215002E0000-memory.dmp
memory/2800-25-0x00000215001E0000-0x00000215002E0000-memory.dmp
memory/2800-47-0x0000021503DD0000-0x0000021503DF0000-memory.dmp
memory/2800-38-0x0000021513E70000-0x0000021513F70000-memory.dmp
memory/2800-71-0x0000021514210000-0x0000021514230000-memory.dmp
memory/2800-27-0x00000215001E0000-0x00000215002E0000-memory.dmp
memory/2800-37-0x0000021503A30000-0x0000021503A50000-memory.dmp
memory/4560-380-0x000000000FE30000-0x000000000FEB0000-memory.dmp
memory/4560-266-0x000000000FE30000-0x000000000FEB0000-memory.dmp