Overview

overview

8

Static

static

3

2026-07-05...wk.exe

windows10-2004-x64

8

2026-07-05...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    63s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 04:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_c329bb613abe57095e1317b3a59f3ad4_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 21.0MB
  • Sample260705-ffmepads6q
  • SHA256 6d3d5fed064e06c95d55bb2a94de6970a5127650b4946bdfa4c66b86bb6c5468
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_c329bb613abe57095e1317b3a59f3ad4_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_c329bb613abe57095e1317b3a59f3ad4_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5556
  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_c329bb613abe57095e1317b3a59f3ad4_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-05_c329bb613abe57095e1317b3a59f3ad4_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2676
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:2576
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
        PID:5212
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:1392
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
          PID:1192
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k GPSvcGroup
          1⤵
            PID:3824

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                7z.exe
                • Path C:\Program Files\7-Zip\7z.exe
                • Size 21.5MB
                • SHA256 d2feadd4ef8504b0a0571666e75881118b64c6f8c89b107e24f53244cc73e87e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zFM.exe
                • Path C:\Program Files\7-Zip\7zFM.exe
                • Size 42.9MB
                • SHA256 d7c0384de2efc32b6e93b0d4fb8825826c7ae1818fd04e93a563fdfa715ccb22
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zG.exe
                • Path C:\Program Files\7-Zip\7zG.exe
                • Size 42.6MB
                • SHA256 1939eeac4c3b3a7f20611af9c906c677debfc621c323b2b63775f449f46aaff1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Uninstall.exe
                • Path C:\Program Files\7-Zip\Uninstall.exe
                • Size 42.0MB
                • SHA256 5b78f27835bab05c675d55489cb4fb3dbd7c4d18228e78092c470911cbef3d1c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVShNotify.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                • Size 42.2MB
                • SHA256 e92f4a88de6cb9bb3d59c170c74bcf08eb2add7e36f5a1a713939cfbc5f48091
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                InspectorOfficeGadget.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
                • Size 42.0MB
                • SHA256 415855ba6d7ad3fa955d3a5dde24a7fbbf1ab8d6e835f1ee0e39b9cc0426d856
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IntegratedOffice.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                • Size 46.1MB
                • SHA256 60fe9ff94cbc3b0abc47e8aa4dbd138852439224c8eba0d4c48a5c7a437d83ff
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MavInject32.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                • Size 42.3MB
                • SHA256 85dbf0f7adb371cb027533c82b0f722c5469da6411a341e6a8b6c8389aa9b68b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OfficeC2RClient.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                • Size 65.4MB
                • SHA256 b006cf2588741123bf664c8f04c82bf677106fdaf83a92de42945b4c216a326c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appvcleaner.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                • Size 44.1MB
                • SHA256 7ccb1c36d48ece764933f9928dcc9c5e82cd7c45b495fa21c45d3bc7598cc620
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrmstp.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                • Size 48.0MB
                • SHA256 b522605e931bfe572ab253872257fc973fe66037677503885182fc94dbe50bb3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_pwa_launcher.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                • Size 22.7MB
                • SHA256 20280ffb22950535386b49a927f224a30761330a2091ef55d762d44082a2bd26
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevated_tracing_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                • Size 45.4MB
                • SHA256 33e23323ebb29ae8dcb5ea6787bcca10be8b86facee6ae29df6f64f2ef1e34f1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevation_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                • Size 44.2MB
                • SHA256 e88064bd439786a50227ef60f6460fe7d34dcb08089cee270174b867e0582489
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                notification_helper.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                • Size 43.6MB
                • SHA256 74b038674b1ca14563e3b3761a9a4e328551c1ce76f7ed10c99e3278d04d3f3a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                os_update_handler.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                • Size 43.8MB
                • SHA256 0a51a8fa21a58b3b32996266ea5a19076448a1def8ff32863edba0a55695f115
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome.exe
                • Path C:\Program Files\Google\Chrome\Application\chrome.exe
                • Size 45.0MB
                • SHA256 45dde45d6aa105c83d5fcd8cd9342db5127b76bef1eaf5eba2f4b4a6545a698c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appletviewer.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                • Size 42.0MB
                • SHA256 f49299c8093de5871297b90d1f2ce306da462176a1b5e963a5b313865bd5476b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                extcheck.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                • Size 42.0MB
                • SHA256 9a817ba7f31a9095d78720129f0946eaed71ea8710d63eb27a8b62c2872c215a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                idlj.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                • Size 42.0MB
                • SHA256 245784e0dd3cbc5474c6e82236025d6a82bbd26edc2967ed754f38c1a9b3623f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jar.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                • Size 42.0MB
                • SHA256 f5bdb5850ec9b7cabc4e7350932d5be1bfd71fda6310a960c0b5c153d6c451c9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jarsigner.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
                • Size 42.0MB
                • SHA256 2ca9fe1c8e0781a3af975de3dc96b98240cf969d8abc53e8eba824b85b3498ae
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java-rmi.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
                • Size 42.0MB
                • SHA256 0a33800b5937fa0ebc6859a11421f39f5e2cbc859978447708279b4d47049e77
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                • Size 42.2MB
                • SHA256 c415ef9bbd4fe5993322f1f31d53fa3fe8a70bcc34b4c2a6fffdff0dcb510b46
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javac.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                • Size 42.0MB
                • SHA256 f5bc8cdbaa56759405550bd2d3e963a07f054d77b22f5b54fa2afa461fbb01ba
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javadoc.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                • Size 42.0MB
                • SHA256 1a8b5864b71323312bd38b94c7f218cf91a94f56ac754d043785eedd12d4cb05
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javafxpackager.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
                • Size 42.1MB
                • SHA256 60564eec35532c0f1ff11d84d8a097d907b4408d473d2d816078a86c8ac8eaf9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javah.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
                • Size 42.0MB
                • SHA256 ef39cc49e3e35945f334aef86fce9874a55c3c7dcf4e171abb7befe6a5d39635
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javap.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
                • Size 320KB
                • SHA256 21e9dd8769a39db9165211e397543c288db6cfea67fb378fdcbfa803d9a215f4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jcmd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
                • Size 42.0MB
                • SHA256 645c40767793a95bca0bfcb73580e80e15f4dde4b72b801b20e39a241d3d7e3c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jdb.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
                • Size 42.0MB
                • SHA256 fe3d5534c2932f6d8c811e1ad7138e2bbee574277400b2ab3a8286fb8fd7b37c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jdeps.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
                • Size 42.0MB
                • SHA256 35918f711e6e0df9ec0ee7bb18fa4f70c9f8e8ab4b400ebd4d3a49022007100f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jhat.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
                • Size 42.0MB
                • SHA256 1c8e5179f392452fd78155113767e7a3be771a8d1a49a7f0c223604ef4b4cf5b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jinfo.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
                • Size 42.0MB
                • SHA256 7a73a99dfb958fc96ebba39f5ad65c1fe57e7bb993e65e6013f8c34e45c0afd0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jjs.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
                • Size 42.0MB
                • SHA256 06c9b7e84700a471e07c768d76c5b8269e485dde05b4f132d9bc6370ccc3281d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jps.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
                • Size 42.0MB
                • SHA256 fc03b5a6d604cb4b8c5eda834b06d32e6a388cd83b021caff021b2735deea178
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jrunscript.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
                • Size 42.0MB
                • SHA256 76765a9910d60de2ee0554333923dd7708db5a50d668c372b9959f97bb344dd2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jsadebugd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
                • Size 42.0MB
                • SHA256 0069a4110da095c2d65d8c903e6b59b668b6acca8222ada46ad012ba2e7dff7e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jstack.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
                • Size 21.0MB
                • SHA256 22cfc5defdab586bc9737eb41457325a44f65fc05367241dfbb9a0a113028c67
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jstat.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
                • Size 42.0MB
                • SHA256 f7d2d8623266b478bc873285804c4c1ab8501f40b737b4604f2fa8cfbc4a5dc7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jstatd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
                • Size 42.0MB
                • SHA256 bff7ac16d667ffac22ff1adb211822b2b9c7139d11274f530096b1cafcd5f58b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                keytool.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
                • Size 42.0MB
                • SHA256 deb6de06a07a626ff81d589e5ec3505c377c1c111af642ececdb992f5a1a84da
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                kinit.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
                • Size 42.0MB
                • SHA256 3724e6ba353f0f3113776c7e746ba448592d0e8f328c116be84e357123388b64
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                klist.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
                • Size 42.0MB
                • SHA256 bca19563ed414c0053a9aeb423952ceddeb6b36caf3e456da8b1d42c394f9c53
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ktab.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
                • Size 42.0MB
                • SHA256 6510005f940c56ba25ddda4c526e0d0491ad49656fc2645a0be8842d5ee1bd91
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                native2ascii.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
                • Size 42.0MB
                • SHA256 570cceb2adbdd2d61cfd76acf0a6554deef3198ce9eac865965958d65d0e628d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                orbd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
                • Size 42.0MB
                • SHA256 b596a4c8d447e48db33ef40a281dec020304b0fab527ad1f64682d1d9fb0e1e5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pack200.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
                • Size 42.0MB
                • SHA256 6eecc2a0bb377a2f139e7be95baa7fac56d1dc119d2815603014a41c47e0c6bd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                policytool.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
                • Size 42.0MB
                • SHA256 1009bb8f173db54c790023e438c5ad2a2a0076175af9fb59ec0d81195afaea2f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                rmic.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
                • Size 42.0MB
                • SHA256 720982b290239107eccc48653fe81ceaf5d564675d92092e37665baa92298df5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                rmid.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
                • Size 42.0MB
                • SHA256 afddbd0c48728c458c8b61e198f05e14ac4578e27a8c016b1dab4f1d8d95ba3f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                createdump.exe
                • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
                • Size 42.0MB
                • SHA256 2e85fa033c17ae21fedae497bbc9509e5aa39d1c6ee6f9cf691713a1ea3dc562
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                createdump.exe
                • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
                • Size 42.0MB
                • SHA256 ffe40d915211230ea6228bb21338b026cd4a31909db8e08ae3f8d30f35682a6e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prep_Activatable Class_Hermes_perf.cache
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                • Size 591B
                • SHA256 dc216c11d6381abdcb6a4b927fd9ea68d336ff63c88639e4a242acf037f90c68
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                prep_Activatable Class_Hermes_perf.cache
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                • Size 599B
                • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/1192-402-0x0000021681A00000-0x0000021681A20000-memory.dmp
                Download

                memory/1192-370-0x0000021680220000-0x0000021680320000-memory.dmp
                Download

                memory/1192-379-0x0000021681E40000-0x0000021681F40000-memory.dmp
                Download

                memory/1192-377-0x0000021681C60000-0x0000021681C80000-memory.dmp
                Download

                memory/1192-416-0x00000216942A0000-0x00000216942C0000-memory.dmp
                Download

                memory/2676-12-0x0000000000400000-0x00000000004E4000-memory.dmp
                Download

                memory/5212-305-0x000000000D130000-0x000000000D1AC000-memory.dmp
                Download

                memory/5556-8-0x0000000000400000-0x00000000004E4000-memory.dmp
                Download

                memory/5556-0-0x0000000000400000-0x00000000004E4000-memory.dmp
                Download