Overview

overview

8

Static

static

3

2026-06-01...wk.exe

windows10-2004-x64

8

2026-06-01...wk.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    01/06/2026, 12:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-01_df6f2ee1422af92686523e629ed10c20_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 2.6MB
  • Sample260601-plndlsdy4l
  • SHA256 59061dd6a3f76224b387f68ab9a203a4f30728188896d78be333cc64235cecfb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-01_df6f2ee1422af92686523e629ed10c20_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-01_df6f2ee1422af92686523e629ed10c20_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3440
  • C:\Users\Admin\AppData\Local\Temp\2026-06-01_df6f2ee1422af92686523e629ed10c20_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-01_df6f2ee1422af92686523e629ed10c20_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2476

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 3.2MB
        • SHA256 221dc5f015e1a7003d96727f519bf3e0e3625475ec01df743da83abc2574fc23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 256KB
        • SHA256 1f7903cd8e272944d6ef0cedd9c2f95cbcff65c96358902633594d55dd22b57a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 5.3MB
        • SHA256 935a4fe7faa7773e22ef127c5f5328879f3079372dc5da6f85b4a8a09e861d0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 5.5MB
        • SHA256 e18c1896c33c9462657f4e46b14d63f1d1aa9903ac4697d2676fec15d41e3574
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 5.3MB
        • SHA256 b07e01ff5090ce0a18463bd780d2ed8c8377f4c23218bc68d597c57b205beb68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 9.4MB
        • SHA256 60122a3726c78560c2438e3e8392d3b75a1cc3ddb1130e043a97d8ee19594442
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 5.6MB
        • SHA256 56fc76a2452ae9e2095dd6e272b90075e1c507e7b6a58b1feddb9fcba3daade9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 26.1MB
        • SHA256 abc85008da1b9e3f0f02ca827bb420b472dc1b231beebd46898ffdba3ce09b05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 7.4MB
        • SHA256 079a81a13b55265ed4d42d4042f35657aca51f0b86b2cef1082cee3b2d2086aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 5.3MB
        • SHA256 b5b600a37802dc145a5ebc17520ae5f8a1a341e8ab3789316ecb39999f30b8f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 11.3MB
        • SHA256 e89f94baa0b4009643d28e7f2656817559d308903cf7e96a0a72bfcfb18667d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 7.0MB
        • SHA256 dc19fc59c522ec4ff346aae38afaa6c86a55c6d781c94b194fc177d650e3818a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 8.7MB
        • SHA256 5facf9813a533331d7f0101c68ed6ed7093c5dbf3769f2ad118c01799b511cf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 7.5MB
        • SHA256 98a5feb2355f52f33ebc115d8e9ce5bb16d94eebd6eb496b3997ae5945ec4777
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 6.9MB
        • SHA256 0f60a088fff0c67f17274e9608c177e8e59c652ef828fb3bc1d96b654ca185cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 7.1MB
        • SHA256 654a5fa16b0a3e5811c128bdbff03bbbf77aec94e7d4d06b81aca1fa1747f867
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 8.3MB
        • SHA256 e9a0259b9e0241395509a928c41a1e6e914b9c3259cb998880e958a3229c4ca8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 6.7MB
        • SHA256 937287be796f6f718cecdfe182ae74c16dfdd821f50bad1e3541ae6274003daa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 5.3MB
        • SHA256 2218af0e4864cde1eca7b11a9996c7f0cde4db31c6e8becafabd4745269d6c54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 5.3MB
        • SHA256 3f131a9c6b2999e94db25fc0a361aa7264c7d721e6769ae4c984f954b36bb3ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 5.3MB
        • SHA256 b6c165bdcae65b316e4fa061785fdef7022aeedc0a1375b570b74f82bd0f98b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 5.3MB
        • SHA256 b60a3a877da80df46928a8360446682d4606cffb302e78ebba9c56431c99098e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 5.3MB
        • SHA256 a59862b451cb9328e3da1a178cb61ba413a1fb35075ffb4b61c1b4109875e4f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 5.3MB
        • SHA256 65bba09782d75d8e89667d0e4c233f1dbffbbcf942a8ba6c2e352537c89b8728
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 5.3MB
        • SHA256 c21ad3fa61f95f798a6fa531fe62ab43d952f42e72e5dc5136cb1927ced937a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 5.5MB
        • SHA256 d0a07db68d1cab99e2ad2097f82207f6aebc02c7ab0d1f72f36685f6d02959a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 5.3MB
        • SHA256 49fdc028e8bf97ed418e51000b09dc77cecbf4ca1a2df25acfcf732ca0b0a2de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 5.3MB
        • SHA256 82760ceb0479b499691a508f99893c193a5944764b97aa5de3df03ac63269c7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 5.4MB
        • SHA256 02642bfe96acc6b6e6889b5c8b9fcf0ed60193feafbec390d3657ab5e5ce6456
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 5.3MB
        • SHA256 bed784679a66e8eed3495114e228516a4e906b556c2ccd219ef21a7fbea81ff5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 5.3MB
        • SHA256 f2549862a81e95f72a2da44278f4a21c12b427c00fb0e43190bab3cea121278e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 5.4MB
        • SHA256 7005f3ecba6b0107c36c59e7354c3b33d7ca9590b79746995b16feb7353a11c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 5.5MB
        • SHA256 1a33ebf26268c7cccd46dc3f530b509d199e944bf800ebc14a5606f24989a600
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 5.7MB
        • SHA256 b0a258e5a66b87df77a9658768a2c531c0d1e03ac8490aba28a137e1713ad2f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 5.3MB
        • SHA256 3c0988855b3bb76a5f60dc6926f8e3b3525915a81f99e47ddd9f2ad4830a4494
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 5.3MB
        • SHA256 33afa2a8acacd2bb6d61ffdcc3432cb21ea774b15dbf8fb4d6973606c6541fe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 5.3MB
        • SHA256 dd596c55d3b1275d67afa722f674c38fbb9af8b9bcb520dc43ca43b65aabdca8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 5.3MB
        • SHA256 68a6d439ab746b2123cae8e0e8f0ce35f1c5c4cca4325c52a0f890cdb8dfa7e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 5.3MB
        • SHA256 d805bd0a7e014d1e662333cf27c260b13348545bc142e25873fc8ad88dc1e818
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 5.3MB
        • SHA256 92f30be4d7f2e8fae6c9ac365cd804b7ce216930a83ef1ec6e6385353bad52ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 5.3MB
        • SHA256 66e8fbb0e72f1909b585624b6383c49c7938fb23cb20803f10e6f3ae4fbb1eb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 5.3MB
        • SHA256 1a9b34768c4bcd8e1d2bad0df7bbe70f09e33e5761b536ccfeec8c5e61f7950d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 5.3MB
        • SHA256 e1c74782ffe7bd8d13d6b53357fe77c92f2ff5cbe2684f5d18b57b88a8dbf7e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 5.3MB
        • SHA256 b5e97e102b08f2364da572192b33ed54b173f52ab0b03c5af68a5cc172c3f346
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 5.3MB
        • SHA256 29940cf4f42f5fe6f236e3ba2d161e8b58ba3d95594e52769485ce00296ee76d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 5.3MB
        • SHA256 ef05efae3b917ef4f70d5fcdf918f895fa1d9672e11d699f78d56a700dfecb20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 5.3MB
        • SHA256 8128eb12ecca6aed86291cb3d7de91ff3027267f24b88851ec55d7425ee5200c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 5.3MB
        • SHA256 a99be5128b9ef048333d33d183df3385e725c3d4cdf1ab7e5ca53c056650d933
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 5.3MB
        • SHA256 fcb9778f9e22cc38bb8b709c627970460a2cad4ce3436f20332feaaae532846a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 5.3MB
        • SHA256 6bc4c65b4f0265236e308b635fc62a0abcec2c4071c1d2762e684ff909b1db0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 5.3MB
        • SHA256 f3bd1764340e6320334a7f0ca79ce14f19a5bcdbf7c95981f66c646eaebb816a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 5.3MB
        • SHA256 4e6f784a029ebed6bb46716cf777a1bde75f164e24944b34cde4538163e921cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 5.3MB
        • SHA256 dd01c17e1fb20e4c392003b1fe962a824506b7505aed57fe9ca722a7a9cdc057
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 5.3MB
        • SHA256 1d293453bc21137eb1da7f4b420c03c7ef44c7a17543a5869389f93a64687ae7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 5.3MB
        • SHA256 8058a04f2adb8b6f05a799de1bea5d90f653d8a821b38680646822be20c2c440
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 5.3MB
        • SHA256 febc2d106e975caf3cf117698a8e16bd020b4e1ddf974a7da18f7451a96b0a91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 5.3MB
        • SHA256 236434022db86358e8c9e360ac4eb5a90c935ffba02194c0c3fa2d1f5a0d5fb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 5.3MB
        • SHA256 9e37cc5c28931fade147bcc51574599b133e2517ca4758aa7bcc92f4822acd0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 5.4MB
        • SHA256 ef12519c7d71cfb7933ac747446f575e19c73a7448dfb9934c57e3f8557ac4cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 5.3MB
        • SHA256 63f3a1d0dcf796bbeb593eabe331be707893b53f4b92086a306cd7f6c19b71e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 5.3MB
        • SHA256 8862a713c0ea459fe7994246b03ea3b27ceac598fd023bf91b693bbc4db13267
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 5.3MB
        • SHA256 35f6a3abcd4cfafed53e5c07a9d7b1ea37cd8c6ecdc1831ac017e1e1173c6fe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 2.6MB
        • SHA256 59061dd6a3f76224b387f68ab9a203a4f30728188896d78be333cc64235cecfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download