c72cf6dfe58fcb4803c058add750234578c52cbb0df2cc19c7ad23832e82c431

Analysis

max time kernel
0s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/04/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-16_6e11fd6010df6fa36ac3421041a12391_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Size 25.0MB
Sample260416-bb6kjsf17t
SHA256 c72cf6dfe58fcb4803c058add750234578c52cbb0df2cc19c7ad23832e82c431
MD5 6e11fd6010df6fa36ac3421041a12391
SHA1 8d4c7f673485b18047ac3d0f0eaf6316489709c3
SHA512 277f913081e5559c57d454cd0e250004b929772679ed09fed1a6efd507eda18889fa452338eb39a265cc0d65fd1d89da2e21a2123539bcad33604ad05f0c9843
SSDEEP 393216:/oUqoUycZEIveahvQHrc8u3xXJ/f4uUWHg:SEIvXvQHrK5/f4uUr
TLSH
T1F547BF13B39680B6D066D2748A578216D7797C444332ABDF33D86A6D2F73BE04B3A361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	2026-04-16_6e11fd6010df6fa36ac3421041a12391_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1656	notepad.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-16_6e11fd6010df6fa36ac3421041a12391_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_6e11fd6010df6fa36ac3421041a12391_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe"
1⤵
- Checks computer location settings
PID:4924
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\WEL1325.tmp
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 2.7MB
SHA256 d80a033e7a2578a1c66e2c5f5c734b7f24c956c368b5f14c7f90ab9846e636ef
MD5 b79d88fc125bbb2fed8c139a327b868a
SHA1 147947f7fee7c0e5d0488cadd196fa30bac13a69
SHA512 eb7a2511f11177afda9c11e56c1fcfa46cbcdb20942dd4089af1b1605027f7951ec8156b0bb5a273fccc0bb3cf9b83f398ab1989558fb12ec765588bc6ef72b2
SSDEEP 49152:TLgVLKRWTQ6Zs5DhgP/OU/zXNUfEeXAxhF2rl/IuOryOvKODjj3PF:eKRuy5a/OU/jIEeQfoR/IuOFd
TLSH
T1C2D5AE1277D58032F2B326314979D3756A79B9614A36899F73C8162E0F30AC0DF36B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WEL1325.tmp

Path C:\Users\Admin\AppData\Local\Temp\WEL1325.tmp
Size 52B
SHA256 be0909be27235c36586ceb9b7e37d8d74c423d9460c4dbf0e2417fcf58b96caa
MD5 17ddbb82a40e2ac704e1045da8fb1cf6
SHA1 a570cdbc16483567fe1439903b212e33b15343b7
SHA512 031adfce17522c42262d40acb75f1db7a1942e4965ab505ee3a5b7001e07a3f16182a4093a3e9a3b99b50860bbc66205a9956b4d8da76adb823054aae6598da2
TLSH
T1449002F35491D6301587051611E8118616566D9675199405E00811251AB56520515DDA
MD5 SHA1 SHA512 TLSH