Overview

overview

8

Static

static

3

2026-06-27...wk.exe

windows10-2004-x64

8

2026-06-27...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 04:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-27_9e0cf871d92ea50ca0accd0eee747c0a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 3.5MB
  • Sample260629-e717gsds2w
  • SHA256 a9c8f4b386e07655e30c821b2bab7eba13f5df7a873011335c01cec7e4dbae9c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_9e0cf871d92ea50ca0accd0eee747c0a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-27_9e0cf871d92ea50ca0accd0eee747c0a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4752
  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_9e0cf871d92ea50ca0accd0eee747c0a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-27_9e0cf871d92ea50ca0accd0eee747c0a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2780

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 4.5MB
        • SHA256 8725e3df5fb22eabdd66b0d1326c2cf6f5768c957b61f102caf4f27104018b41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 7.1MB
        • SHA256 539e712a6e6a46a5764ac88795136073befea3bf93e5ef242dd9217fbddc588d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 7.3MB
        • SHA256 5166b1026f89218f265a215416a9d96366536e21d74963634b7bd93ea0fae94f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 7.1MB
        • SHA256 b61b19f180ea591a03698a83a2e8a6c013296d3710bef9e7b813efe6e63875b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 7.4MB
        • SHA256 b06f7b64d308aea09c88b2d480afa0d721a7598a48bca9ebd0333a674b1f5769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 27.0MB
        • SHA256 9030c9754f820ad582505abbdc08746c3e6234c4cecc6a74c451803234f4d0bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 9.2MB
        • SHA256 783e04fe5349f0487fc2acfe5ad7ea8302d6d7350d03ed9b37dfffa58e969acd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 7.2MB
        • SHA256 bde36fb30507c7d56c00b0fd3316d0674991f46d9deb4057754cfcdaeed36162
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 13.1MB
        • SHA256 c598c60eddc51c26f3675a8e2fcd0fecb0879c7a9a03055f064b43b698542170
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 8.8MB
        • SHA256 471f9af582b35feb863afc303c0c5c7a4dda276bf66b92aa623fb75e3649deb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 10.5MB
        • SHA256 71ca5cd3cb414c0fe2b9f55fd9a52b88485e51ca7244786b8755a78053ce5294
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 9.3MB
        • SHA256 f5472b32d949db4c44a6bb8a24e7ef89a04957ec4201bd921ddae0e2139005a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 8.7MB
        • SHA256 9fdc01e4e71fce40d7f2a068bfcc88e607c7b1c68e7da1568f8c98f18f95a59f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 8.9MB
        • SHA256 c13c11350bec1be3e45ccaa8655c60231c611b3c5aa459be0c9608d2e6efd529
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 8.5MB
        • SHA256 e972543a5247414b0c124d51bc0fccf709756dba195507854c7ba1ce485e4098
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 7.1MB
        • SHA256 e859c603801272bafd5e42de45431be4a6c22ff67c26a420cbab414ee242d576
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 7.1MB
        • SHA256 543b710bb75d8526399dbd2a8a4bda01e834890a6e33562b994dfa4ba6a879fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 7.1MB
        • SHA256 8fda316dace0955fd026474c14c56f8bc03ad2408ad06332ecdcae690634ca06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 7.1MB
        • SHA256 8de8632c454ee2d5c87f92ef6e896008a74dfc4a198d2a95d144b55703b852db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 7.1MB
        • SHA256 7b98dc76ed98f0d46e652d834986249cd8ff4c10c142bb09b6bcb9a3b71da85b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 7.1MB
        • SHA256 e58622f489fe7ad02de8c6d8f07da9ff85234f4771fbfade73f61381ab470fa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 7.1MB
        • SHA256 6be04aba04ff10d1c865ac2d7dc8fa42f9cc9e70fa99b22d707dc672c2ec1208
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 7.3MB
        • SHA256 93113015551614f831cf522eca254a6dbc574534cdcfe88b6945029089590b8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 7.1MB
        • SHA256 8e96b283576842469790d4c8ad90d0b6d6c88caab9a2004e10faf6025fc16c9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 7.1MB
        • SHA256 3a99a3b44b8415c00ab9787bf2403df96d71f5a01bd4f49c5ff13e8f99745dad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 7.2MB
        • SHA256 a264b50bea2fd34c18624a656b0544e279438f474bf071d3e98b6504cc23af95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 7.1MB
        • SHA256 1fb607733cba75491384231b767731fe922c2bf654f84d2f28d7cb03e5da3850
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 7.1MB
        • SHA256 d42b13089f5ae9aec3f1b15e9a33efeb9d1be01622f93ded0722ac10ade268a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 7.2MB
        • SHA256 3db272cb82573c5ef4bbaf66e0042f79074c0f779068b57423db0505180346ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 7.3MB
        • SHA256 5a7e6bf564018f6f2f97d9dc3567c1ea247c6ea1de82387769d86a0425b26ffb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 7.5MB
        • SHA256 9697b3f6014d730712278b3710d54e3747dca0437cfccfe38f6dd9f840262bd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 7.1MB
        • SHA256 a6e2e53cc0343bca6d78c8c8e746c5d096f48b1f8ea5d0dee6d63cb2b4c29015
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 7.1MB
        • SHA256 352cad287fa6c38c02cff8a0bf59759dc25a2fd87fc3193853e8c7da5c50d4b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 7.1MB
        • SHA256 55866debfa9ca4bdbcc8a618befa31829280a2fa5a1dd26d0c6e3a89086d17e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 7.1MB
        • SHA256 d5f7a6fce59525ca05bf9f60315ef90f2a3a54817a66beb092876dd860b61f39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 7.1MB
        • SHA256 be2717eff64ee7ee4c88f39f1ed59afaaa3f0bbf7de6594fbb3e1b12bc48d52b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 7.1MB
        • SHA256 14a214ce9983b75f0438308e82f15ca75d4bd9eb3229a1a1335e345d0dd607da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 7.1MB
        • SHA256 88f00ebf0a59715b417cec4a42b9bfb8cddbb17373d1cd86b618567df7159897
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 7.1MB
        • SHA256 001d48df887e08877d67359afb074251f882a43c160a6d49a2885364f2a6a343
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 7.1MB
        • SHA256 5c98835e812f5a4b1e5c62082219e209b86bdb9d7cec27156002b8c14b0563e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 7.1MB
        • SHA256 8297c3258518dacad2e09e4846acf000b5f8c30ddba6a5641b60109d7199aa30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 7.1MB
        • SHA256 ad3fa55111513fffd73a5658acab58218e723e81fb3476271f98666259b08535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 7.1MB
        • SHA256 433f8a8015e20ec3f4be0b2caab9e4c1d3493f3f35ba0ac93ae693ab8506cf1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 7.1MB
        • SHA256 76b747e51efccbb3792732258494a8769751af35af526f9c1e1d3377792767af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 7.1MB
        • SHA256 90e93b03109ce6aa7015c9d6857429cde718e5d5f6b5b588671d99511d0ae483
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 7.1MB
        • SHA256 a771d46f7fe5ff92b670cbe1b2103e2b7c890e0e7b973c628afe6c6c948a59a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 7.1MB
        • SHA256 50f68388780c06bb7783158d97c717263e0a12ae7840e3e42875988bdb3da8f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 7.1MB
        • SHA256 86076ab1ad185750859e563ab019633833d9b6197d3077e60be422ccf87dbe9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 7.1MB
        • SHA256 ea34951365e61c0b09d03eb5600cb029a4b6ad2196fd3b0b2bf91ade8252424e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 7.1MB
        • SHA256 0fc4fd1ede29289cc8001f35ad62d409a3646f4d2f82a3e19c1d07014e9f4f55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 7.1MB
        • SHA256 bfc1feab3b21531b9c9298f6c32a34952e55c60174b1e012558a886427d7ff0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 7.1MB
        • SHA256 aa8852ea3561977b232f198315d7f9a5f098b79d35da545145dd3933f04d19b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 7.1MB
        • SHA256 9719a7784ede758a676a3de3ae2fe0978b23b1a80de7e8569fefc6dfe426ca2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 7.1MB
        • SHA256 3785a9fe1f005d76ccefac0410efabc086c37c78b0fd091cb59933e10988f5ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 7.1MB
        • SHA256 c45cf398c22053ee576ff2de3fa6907de639f50eb3538367cfd0eb5f271bfd89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 7.1MB
        • SHA256 1c79cacc4c93becf5ad4874db0840e8c6b6bab42da65464f23cab11b0117ae03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 7.1MB
        • SHA256 d2c0fbbb0b1abfaccd9291f6fe27bc6f83f05b39c9d2cfc54b2c3f9497ca4cf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 7.2MB
        • SHA256 6e47bd2959f361783320ff84a1e87ba94fff0d90af9f541c21f073c19cb99396
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 7.1MB
        • SHA256 0d87ad559e5b2eb2700ac8831feadf638c8efa7fefdc8c831376e49fa84d639e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 7.1MB
        • SHA256 92f3fcaf84083edec78ad3555d7d042ca17365ffc110c038faa03842e1e981d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 7.1MB
        • SHA256 6b7cc37a82534f9e8449b6b0e5165daa3990ae814f22d24aec166c1070cd8750
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2780-324-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4752-279-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4752-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download