Overview

overview

8

Static

static

3

2026-06-25...wk.exe

windows10-2004-x64

2026-06-25...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    98s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 20:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-25_c1063da4258fe3ac878d2b9330031ab7_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 15.7MB
  • Sample260629-yr68caft4k
  • SHA256 a63bafe99944d6d07d29f9939d03641372dc819df55f9e00860dfd482c54e260
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-25_c1063da4258fe3ac878d2b9330031ab7_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-25_c1063da4258fe3ac878d2b9330031ab7_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4500
  • C:\Users\Admin\AppData\Local\Temp\2026-06-25_c1063da4258fe3ac878d2b9330031ab7_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-25_c1063da4258fe3ac878d2b9330031ab7_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6064

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 16.0MB
        • SHA256 1b8e7e72b1363e493ada90a456d81ef9d9defdc4008c23f31f33a06ebe30010f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 31.4MB
        • SHA256 282ebb5e054d3f00e0ebc6166f7d98f9d78c8fe93e256231dde3b4900706fd62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 19.8MB
        • SHA256 4b723374e750b6907bd0e1198cf8dc2a7082287f69f501f3a61dffde194573ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 15.7MB
        • SHA256 a63bafe99944d6d07d29f9939d03641372dc819df55f9e00860dfd482c54e260
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 39.1MB
        • SHA256 318f18ac09bffa9d72d1c1e9a9a64ab82f4613a4b3a738516ebf1418ddcfe24f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.8MB
        • SHA256 798930f8febbbb0d986c0257b481161971c465afa0d0e157925b5d592de5965c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 31.4MB
        • SHA256 3af170ba196c2aa5c4d92df719810a4241bc906b814b8e1f9e08e04ca085f40f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 37.4MB
        • SHA256 45dcdedd826b6e55cbb053376e346bcb14d6f6f2845fced0cab2ad33211d8ba4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 33.1MB
        • SHA256 6de0f48a60c7424c932490ae9bb0fba60ec9b71dceba453da1950b0366bb0dee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 34.8MB
        • SHA256 07c450876301d61565287403c8fde7d3300ca819f7270674c2098dbbf9c5b5bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 33.0MB
        • SHA256 454074a40d85a4708ea251aae5c9f046c6327fc4285b4ff0181ca93fc6ed3c2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 17.5MB
        • SHA256 1bf0a7457591326a51fc8616c2f815928d78d55b2f7ec6a9cfa2c6822caaface
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 34.4MB
        • SHA256 957fb5ff353379ec59ebea6bac16e61b219a879b0a239a5d8ed133e5f8c14fde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 31.4MB
        • SHA256 097024a3ba84d19ff7245ff3d24123bbfa5dbbffc4268847c145282e7072992b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 31.4MB
        • SHA256 5cac13db25e6d03bb159e519a72fd779aa08c2a2dce3e821fec6ec9d4beb5c17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 31.4MB
        • SHA256 4c64668d32f90cb8edd5c43a968c0874e6a530da1c8c312f469e467631179cf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 31.4MB
        • SHA256 3c9b9ae9e070c928701c8c8016050e09c3737731b4cfe483ca6f36ca52fd4c57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 31.4MB
        • SHA256 8812a960317046e748f3e65773ac26edbd60be6da5d6e4063fa2388d7a9e79aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 31.4MB
        • SHA256 bfc1ab1511a243c16fc02ab2ca843febb863a809687a96e52c2766a575bd83ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 31.4MB
        • SHA256 9971d8112ff2d8f0662216b76ffabd67bc1ce1c751e5c1aad5ddf2e8aeec0054
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 31.6MB
        • SHA256 e57ca898eb222612bb45308f9ed778a6936445a48b651dc19e3da99b2bdd208d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 31.4MB
        • SHA256 904a5158237ae10be8a405f16bd43d377128c86dc3d52858ba0c8d9e93d2d387
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 31.4MB
        • SHA256 d7e238174eb115c7c11af1a9780ec7ce92e82648002d34080b89234cab31b6f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 31.5MB
        • SHA256 d3df7a326bd4f1113562957c125132498cb3cbed0041154390f4c16427bf6f92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 31.4MB
        • SHA256 7eff4db1d9784253be94001961637fd964ce3af05b69aed6901d194f3f0d062b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 31.4MB
        • SHA256 4abfc9650b0f8dfde76f6bdd3d74e17207561088a774eb94cd465dc5ba728899
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 31.6MB
        • SHA256 d02affe75e681066e873e703b3eb38c9573f2383ade8e15278d94f2d2bda2e50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.8MB
        • SHA256 67ecc4b3cdf39a85d6deb1862f17559d89f1904813e37e1ebc134a9eaa5423c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.4MB
        • SHA256 32d801ccdf887896f199759523959296658816f908ad994c6512aaed46a76d2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 31.4MB
        • SHA256 1ee7f117de217a71e6210dc98ea80370ea18f1c5032bc4fc1fe9e86be93f2363
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.4MB
        • SHA256 6469940621c4d34e335e212c6a4bb269298466e56c5caea65bc3a05e5537358d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 31.4MB
        • SHA256 d1b091896a946fdb7353980f17e477cad4ddacb85305a616900c1c1282ebba29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.4MB
        • SHA256 e4b586999525112818b51d98a6c295b3053c9b4744f5b8b639d4a7e46e2ebc0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.4MB
        • SHA256 3c05e9a2f6f6fcfd82111145e5e89d872e734838d1a3f527da91186d3d14eee9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 31.4MB
        • SHA256 5d33fe60e4c535957b2094e3c3b568428f4858b983168093ad657c83753f1e82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.4MB
        • SHA256 12046d40ccb1b69c6ad1ce97098373e49720d43571732ae46fd87887bde8685f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 31.4MB
        • SHA256 d349589aab92451cea77435e38d5748a03d593a99c3c68a08a4ecd8a5027f1e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.4MB
        • SHA256 e2448a732d83fbb0b82dac6c2fc8d6a7f763fbe94016dbc9a39f77b42b8a5a6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 31.4MB
        • SHA256 0b3e81315d68fee2f83d144ae144a2abceb408e207f882aedbae26461242b6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 15.7MB
        • SHA256 97c0708a850286c3b3569d23567111194ae53a6f1cc792cf0ba580afb4b8e3ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 31.4MB
        • SHA256 0c207907745103e9cf1f387049950643185d0e261c0767a57824f54c0a2c2362
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 31.4MB
        • SHA256 e12e2332dd43757cf6c38415aff16d341977fc18ac3566d94dfed5fb301e1317
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.4MB
        • SHA256 9f179a8af9686a2b1cc98b4dc25a398ae2bd38097cd56c7897632c23fb6c1376
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.4MB
        • SHA256 69cad641f71118df9bb31c1fc96c194735f4bee23e12800394f4ca596b3c6aa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.4MB
        • SHA256 e349246987a03293741fcfbc08a36e4bdaf299c58645401f07df1640101de079
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 31.4MB
        • SHA256 4642bf074a9c6c8361d17d8b0be6866470ea57d6a8dc6280b9f801e985747aa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 31.4MB
        • SHA256 f8606129e8ef44e7800fbabbf42f6d6d1102b12dfb9d6d969465650d56b44e34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 31.4MB
        • SHA256 b1de6e4c0ee3a607b8c3ef734cbdfd3230f324bea2cd907e4d9dfbf0199350a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 31.4MB
        • SHA256 c703030ac5fb1030708ed99971be9f8f8d186adcef2ed8f238004dcbdfd3cecd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 31.4MB
        • SHA256 dda6beaa1d486d41b65f976507dc2b0348817f0677bf67eae254341c1a70b15d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 31.4MB
        • SHA256 e5a97c8ca8e69c25003d81f5308eecd8944a3f04b363cebeaa0d456931cb8227
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 31.4MB
        • SHA256 b538600dd66e0e4d81025719b513881102314043b5bc24258512dcc247d2b631
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 31.4MB
        • SHA256 1d45491bfeb8dd547b863300cf21a5b4df62cf5b7b0aeb1a201c5368923609eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 31.4MB
        • SHA256 408a0826ecda91d0e0cd004e6a973788e8c4387c53a94a3dd6a1e8cb3fbfe447
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 31.4MB
        • SHA256 c3df18165398e13a5e1f30a981420d4319700bfab869d60dd0033e4a66498d6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 31.5MB
        • SHA256 bbfca47e81769db66927cf665919f122c796e70e02fc7858fc4f24759306a09d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 31.4MB
        • SHA256 82fd41ac656e7f75c0ba07ac84d3a81e1e5c5f0eae451a7989ba9ece32a44088
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 31.4MB
        • SHA256 554dff426b588e359b2b50f4d1d85fa0e516763dd09245788f4de1676d57d1b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download