Overview

overview

8

Static

static

3

2026-06-04...wk.exe

windows10-2004-x64

8

2026-06-04...wk.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/06/2026, 20:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-04_320fb3e8925afff1eb6fe769259f5da5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 28.4MB
  • Sample260604-ysj47sd16k
  • SHA256 3343e6927c4861f20462eb4290686d04a3a7a2ef043c603bc40dedd6821e3dde
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-04_320fb3e8925afff1eb6fe769259f5da5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-04_320fb3e8925afff1eb6fe769259f5da5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1264
  • C:\Users\Admin\AppData\Local\Temp\2026-06-04_320fb3e8925afff1eb6fe769259f5da5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-04_320fb3e8925afff1eb6fe769259f5da5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3164

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 39.4MB
        • SHA256 142cfce78b3a98fb54f8484bfe01ee3439dd624972aae68a08e06c99c5f6a5d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 36.7MB
        • SHA256 d355c35ed0432a47406f58ec7fa6e9d503c6dedd13e873b76c05b181c91b605f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 35.0MB
        • SHA256 5ceeeb5e5ef6bd3f620e36733da29426707e41d69a5a549b191ca8cda5950c56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 39.9MB
        • SHA256 3be26916871af8d6c58575f8d36fede7be4f123da052ba0c12969f186439cd2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 192KB
        • SHA256 56d5b720b4307ef448fb38ef6495ea0a6fb25e8bfa8f9c140729b820c8e0cc1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 34.1MB
        • SHA256 b1b043eafa1e0bf0fcc2a194564cfbe837449cfbb742c4e09ab86b9b64d6dfc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 32.6MB
        • SHA256 5713cb51a4abc2c308122bbb72a0a16e6325c38168b46ff9007d569644154754
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 33.2MB
        • SHA256 b34e6c23aba5f6a80e22935743f68f89749d32dc5f3391e7b4600e899bfd612e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 384KB
        • SHA256 3e4e65210d0ce663e458df3dc7915e7345a65463edc2c4781b0feb1a0cd3389a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 34.8MB
        • SHA256 bd4cb72194a16f18b3f8d08424ea5d0dde62ef36117f684e0c15e260df3afc32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 29.6MB
        • SHA256 c3d5c5baec1f5fbf8cc358a11a8784dfc2f4d556e9594c62c81cea14a69ba8ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 28.4MB
        • SHA256 8973ab35f271f1b4b35f8af40c2c3f171313349cc08d1f42bdcbcf1c34c46be6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 27.1MB
        • SHA256 6eacbddca625c82e416ac5741aed67db549b73463946079f48b58885e13393e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 29.2MB
        • SHA256 5868febb9173a2a4a353e198ee80938b4f0923e2c76d08b4277b50643279ae57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 27.8MB
        • SHA256 5926bbb738c0c5f786fcd5d06a85447192054449a9582f0a3850b5561592e0a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 28.0MB
        • SHA256 c918b06519af9f6c55ae9732a1acc4e98255b6648b31c89b2a2ab0c7c13bfeb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 27.1MB
        • SHA256 a02eb236cf5ab401b92c7ce67491035f7ecece37ccc8a411504c9b386dcdb5d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 24.7MB
        • SHA256 be205719ce67b671322ffa60bb1398810056c366b7f1d2f5008a440bfead1c09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 27.0MB
        • SHA256 b848f6ef439128cf86886d6471aca396af607e722daa892835e4dab6aaab71a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 25.9MB
        • SHA256 021bf749a808acf7c7d34f69fe1b0d379c634894c3b597c23579513073b542e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 26.7MB
        • SHA256 a45467670454184a3355dff6c297b343f4635b9c1634192fe8ed8e3d5ad6fcee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 24.6MB
        • SHA256 b05bf3490138e95fedb5180962347eb90065a5c408734d0b241f023e19cfb705
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 26.1MB
        • SHA256 2c1561d37aa462ea21f1ddee34bda85f2c8eb2e94fb535916e12709f0ca2626f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 25.4MB
        • SHA256 e6665f0627a4f8b02a4e21a4dd64ce6db3c5492ef5e8a67a40a074232b57eea7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 24.6MB
        • SHA256 1c9fd6c2e32d913887b038110824c10d49770830f357aed1e916b8bb861134be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 25.5MB
        • SHA256 eb786990853f91b99595b404b1f5aa3c756bcdcce929dcd0784205408dc3b1df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 25.6MB
        • SHA256 98a0e1635131de62a346cec4d74227734c634772193b5ce150fe6a36dc37d96d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 26.1MB
        • SHA256 2f8af521abab8e37a5b9fda2b3c2c2c9feefb4e4cbe7519b1794a71c0ad62522
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 24.4MB
        • SHA256 66bc767ac560a05721872b02df0112bc09ee632eb1b9fe0bf7713f647b140e16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 25.6MB
        • SHA256 975e4c4668d34e2daba1135a77551cbc437f3c9b7e9c81418b5f5ce815d11b60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 23.6MB
        • SHA256 ef30f0db37f29421247b6ec46dda7afdc42748b1aae89b71a02afce81129fa30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 25.1MB
        • SHA256 3a6b498b07eb0046834284b842bfe2a4f639ac68201d8484c6f5c3e8e9d2d5c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 25.5MB
        • SHA256 8af685e37997d93dab99e0581a64a760ee7b494d30fa27ee914c70da7c57f2ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 26.1MB
        • SHA256 cc7316cc2ae63877c21d5314f14cdd3300e77b63739318c7877b4e2c107995d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 25.6MB
        • SHA256 fd4b3e2405ef1e5dda8ae12697a6701f5391ac5a67f90eb97cd62698628d6659
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 24.9MB
        • SHA256 56d5f68b487f1a065067b1961608d9f065f17f6b20936bbba933b662c84ef4d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 25.1MB
        • SHA256 18fac4c7216bb5c99cf0bc7417afa7c5a1d1eb32ca3003d2d36f69985326a3da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 23.9MB
        • SHA256 f869187b1940ee2ca88535d5ff41bcf5147f59863d9ae8300cb1c0175baab4bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 24.1MB
        • SHA256 f659b81246688c582acd97967b05fbc263ad85b2ee08c242b013cc503c4dff33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 25.4MB
        • SHA256 3b19ad4a91a3bef849f6a92fcc35a9fda0cd057b388d3fa3585e9b90a9e0a9f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 24.1MB
        • SHA256 6b8f078f5b74a771dec3fde85b9b90bd9878869f24d4f277afbf913ca1157181
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 25.1MB
        • SHA256 96ae71fa74d0b0e91d82d698f9048d1e4310f2c7c713276b095bcc61c71fe7d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 25.4MB
        • SHA256 47185b24e81526cd355e224be8bbdbafdab01a3b12799be93093b6e64cf055be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 25.6MB
        • SHA256 f94026d1f9f48a5e66fa1159737ecef3b4984d315bf20bfdeb293807d485bcb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 23.6MB
        • SHA256 475dd7e7642872fa544c67e928935be5784616b953a0ef22894b3857f9d6dbd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 23.4MB
        • SHA256 bf0da43eb42f790fad77fb9b06e6edf8a98c7748a2d908db2e055a3f499d228c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.1MB
        • SHA256 98dab274755ed49a866cc2d380a9410ff26489b0dc4b9cbe5d826aee2e38b2af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 26.1MB
        • SHA256 e3b735d9d6943bc0e504f314b3c83e2eec00aef24710896391a28d53af71353d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 24.9MB
        • SHA256 fc7b3a5ac36327558eed56fcf169b9cc03639ca62c5a0492c00c321db7506be8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 32.8MB
        • SHA256 5b8dd5ba986f72a8374d2d6b0ddf885539d23a16f1135f8278b3bd4500470820
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 30.1MB
        • SHA256 65c2b7b5d2388688dc6bc87fa22c638fe267b61e55bf15ac5c733fd44cd97d0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 29.9MB
        • SHA256 5fcf7a148e1ea053a8256f4789339c6a3f3264900910088f3cd55420f732a85f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 27.6MB
        • SHA256 f129255852fa85c12c6bfb83b96b44e3ede9bbb3e9d4f326249b344e96f23183
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 28.4MB
        • SHA256 3343e6927c4861f20462eb4290686d04a3a7a2ef043c603bc40dedd6821e3dde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download