Overview

overview

8

Static

static

3

2026-06-02...wk.exe

windows10-2004-x64

8

2026-06-02...wk.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 03:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-02_64d90613a450152abb1984ec165d7b58_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 23.9MB
  • Sample260602-dpckqsdy9k
  • SHA256 4b8acd8f131f031f6735dee8b2c6ab26b3c0e2063b967424bd18e2755120df0b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_64d90613a450152abb1984ec165d7b58_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-02_64d90613a450152abb1984ec165d7b58_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1704
  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_64d90613a450152abb1984ec165d7b58_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-02_64d90613a450152abb1984ec165d7b58_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3772

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 24.5MB
        • SHA256 7f09631d25b65a1573530dd12b34f5eeccb3ae119f8da6dec50943cffaada0f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 53.8MB
        • SHA256 f54ad2b0bb03709a339df32f8b61ac39562d50554571ed96578456653cbc6c63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 49.4MB
        • SHA256 663441b8fd771c25ad60709ea4298fe865a606adbe489152f0120c7f90f9aff4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 51.2MB
        • SHA256 a7a988d8d0dd1bd033b1c539a99470e7fb6ea93258c880c4e68720e97db0002c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 50.0MB
        • SHA256 f52c2798c3e04f805cc35dff5c60196fabbadd1bd360293f45887874b5159910
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 49.6MB
        • SHA256 72fbe69e4445b02fa65c8f099722eaea97f0569b58457c585469cac5612dcca5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 49.1MB
        • SHA256 c93e13290bd9d5d9a2775ea11e38f0a473e5b63d269d0159ebb30765bbcc9a3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 47.8MB
        • SHA256 a4bbe55594c6cca443d96a1d9410642251d82cdd13aa589fe46d237d3efed5f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 47.8MB
        • SHA256 d2d13b695e34fd5d87de4f78c31b0b71e14b7ab5288563e0a688bdf48006228d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 47.8MB
        • SHA256 cb38caab414a485932fe3efa11a810e36a1764a5a5693080192bd429eb61e15b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 47.8MB
        • SHA256 abf0ffb5ded679d364d1366a2d85abb3b967f9497c7dc74e4a468071e2c670fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 47.8MB
        • SHA256 cefac94df6b4ff0bb382b111aec7a7527c00a648f11f86bde0359df6ece9196b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 47.8MB
        • SHA256 6d9d26e32452c25fab2b6fefce26f8115dc107e13638718cf5a0b0ba1e1ca065
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 48.0MB
        • SHA256 6c71321230e55330a968d507b079910961319e8f087878babffe9fd0d878e654
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 47.9MB
        • SHA256 d9216c7833d8826026de97e3133de7b62cdb88b12a82a85f9c59f7bc126823d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 48.2MB
        • SHA256 ec9fca983d3f861e317f7431c7018e78d9a4a844c5b3d159f769b568316231a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 47.8MB
        • SHA256 7e2ba031bbad71b7d610382a9725611c694fff3a780c51fa79022056f2c33e62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 47.8MB
        • SHA256 8867119f1fe58a5cc82e12173aa1f2e0b9a0cfd5e808d7cce6f484a8613e4694
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 47.8MB
        • SHA256 197bbca66cb01aa3ff94dfe8c5bca043f76a282888e2d3a59136a7b7ec74452e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 47.8MB
        • SHA256 c6170c7799946223015dadbe6e93fa16ffafa0b9d8185e4ef62d17fdbf059a05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 47.8MB
        • SHA256 522b5a61bc945fa4df5d8071e0c448c53b25ee4bc6e5c7d67088802437b6b9f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 47.8MB
        • SHA256 98eb0e70b56cef9b3cf374a018c86e57b765b80da2b1fd122bfb096cc38c3232
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 47.8MB
        • SHA256 5bc9ff6df3d695a048804a418ab83c8e96892f042af3d7537d545050324396d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 47.8MB
        • SHA256 aa1ab7ba04a69a57c2ef2ab99da803acfd1d1c2259353c690a1ba42582a7b97b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 47.8MB
        • SHA256 24e87910306b38f428e6546233b60f144404f8a67176d36c83f3e0eeb845d4e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 47.8MB
        • SHA256 7d4e7661af82be1b5dd258fb6fd0ff00a7c5d1a5b8e4e8c3122617fe44058acf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 47.8MB
        • SHA256 1d71eb32a5851236a7a3c4cd223f3f29d9665bd3489a5dc9e3c4daf171052411
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 47.8MB
        • SHA256 6ffa0717b979b0010973a6e893e04f436305c9e1c56ea6a71677b33ca9198ca6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 47.8MB
        • SHA256 067d05a4aee36831d5e971010d146e5e2632d3dcb2034976f2ab0ad7d7da12ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 47.8MB
        • SHA256 45df980091fe36ce6baa6b779a28f8eb974770cb14809019f432a19f2fc22340
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 47.8MB
        • SHA256 c9926c674aa622e2d75c6f1e109392b17f01027f99d2c96c123e59ac9bb6964d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 47.8MB
        • SHA256 864110725348e3e7defb534887b0203e54105fd5b54c2394ad85949a862c3196
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 47.8MB
        • SHA256 b0bfec35d1e7692c6e996ac10ce9f749b3e0358fea2063d0adf5a3ffce938aea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 47.9MB
        • SHA256 af534ecf4dfbfb363df67a2d202c93c28fbef28ba6f2ce8d986acb2fb3fb8006
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 47.8MB
        • SHA256 e6d626155c9681d6138b7448e8fcad6ddcf58f432e9d90baf12603a54e2f0106
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 47.8MB
        • SHA256 f6a2abbca3748b0e0037859553dc587b526c1d2df3524b07641c5baee82b928f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 47.8MB
        • SHA256 bb742617a380e127728bb6621d0753408153175e567fec60be054252e0da586f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 48.0MB
        • SHA256 ba8437a622c6cabdabd8f369bae9eaa456b985e9fef89816e782401c9cd172bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 47.8MB
        • SHA256 64384f6dddc5ef9c8b7d637da335af76280ddcde57e969b6c7668801b1376240
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 23.9MB
        • SHA256 b538cfcbbe595ee01d8cfe7091c8276ab12886796fe4bbad5ed177c8b447ade3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 23.9MB
        • SHA256 4b8acd8f131f031f6735dee8b2c6ab26b3c0e2063b967424bd18e2755120df0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download