Overview

overview

8

Static

static

3

2026-05-22...wk.exe

windows10-2004-x64

8

2026-05-22...wk.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    22/05/2026, 22:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-22_140079ccf5706af58c7c8751bcac1a32_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 14.1MB
  • Sample260522-2raqxsfx3n
  • SHA256 9d67efd9d21c68ae3a32c94c99f54a4821869e507c45bb925c5f2e5dc4893eac
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-22_140079ccf5706af58c7c8751bcac1a32_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-22_140079ccf5706af58c7c8751bcac1a32_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4444
  • C:\Users\Admin\AppData\Local\Temp\2026-05-22_140079ccf5706af58c7c8751bcac1a32_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-22_140079ccf5706af58c7c8751bcac1a32_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4644

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 14.7MB
        • SHA256 11e57c85f98c1d11f06fe5e0c261b30d2603005daa7ce94a276126d6b7060613
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 28.4MB
        • SHA256 3a50f9f33376ab3143c42422ca7065f15da8b5c92fd1e80e6e974715137fc4ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 28.2MB
        • SHA256 8ff7db8ae4b5bc36d2d4446c2da2c54c38a32da1cd85ebe519b8c0ea96322815
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 32.2MB
        • SHA256 50d42d7f4ceb5d3788920ba95f3049834e417def58943d8d71b20dfb7493357f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 28.5MB
        • SHA256 64e3231980dd486d3b6b145fa68f8622caa75ead09d87211c92f79fed8c8c756
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 28.2MB
        • SHA256 d3173e033edcedb43c419d413ec562b1a3a431e87f400fcc792a308fdde62a11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 34.2MB
        • SHA256 42c2f440f310182a084bf400462853d9434c4b649a1a85cc40445429317fc9c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 31.6MB
        • SHA256 3ca9733adaedb95db70ef911941c2b25aad7cee96b07fa9671d5dc4c037f160a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 30.4MB
        • SHA256 18ccb876ec542bb0182150ed039c032155d681e53a0024cc7678b4308d122741
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 29.7MB
        • SHA256 877e02e12b1260d61a71202178972be25804bbc4d158fa7c5cfa8bebe21ac247
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 30.0MB
        • SHA256 a1f4660ad3075906595e379ce2ef60f6de04d4dbc377b017c3791f9ab2298eea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 17.1MB
        • SHA256 cd15b66008beee5ab020a05c4a6358c5fed4ce9ee6f3e901b880e2410bf920e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 29.5MB
        • SHA256 02bfc185543433bfe4b420dbf9800aab009651e82dc01c42ee10697178eb786d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 28.1MB
        • SHA256 ffaf677f9b0ca7a3c5d2f38e3f30a4201c0c82ae2067477ab94602750750d32e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 28.1MB
        • SHA256 08b28b88e2b0787f300df7d1ea54f8e84dda24009375e370380db68bfb0f5462
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 28.1MB
        • SHA256 2b916546ea17d95432f2912b338470adff253430dd8c7ceb579315075a7472fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 28.2MB
        • SHA256 556d1291779ca1369adcb6eaa0e3431acc3e5d9efa11468ce3d20c2d26a66f97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 28.1MB
        • SHA256 8261df1b0f4388cd9f72e46e863d1659c6a243ccb7ffdea4cf6dbaea98be668c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 28.1MB
        • SHA256 7ff23c06e923e940bf57c3b35f7d7b320866e33b4be79b6c9a89cf713ae9f108
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 28.1MB
        • SHA256 99acb3dc820b43ed2c397a9a5a4f77b2e74c808905b24e3f6255b6b2da1e7ef9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 28.4MB
        • SHA256 973c5047aa1a1eff2113ee1d4cac20e166ebf7f4017f4480d62f071f86a7acdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 14.1MB
        • SHA256 6b17cce8dc62f2c2938e039daf544b8f17c8b61e3e3086331838bc2cff7ad54c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 28.1MB
        • SHA256 80607f718a806047adc24c3d333a3448a93f2571d2f1c139be88d79987edae9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 28.3MB
        • SHA256 728ece71894cdcf2e58ea0a3c68187c3c154d12b98b9a3823b8832987be8e045
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 28.1MB
        • SHA256 32ab8e772b89c4177b962316020fbc876ca161a4dc02dabd2ae5b1a8a0728773
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 28.1MB
        • SHA256 0cfa48700eeedf92b68d716041e77051400a28f3c5a19d64eac2da6108e82dc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 28.3MB
        • SHA256 7453b4164fba144f5a5e490f290d544b142d8abff3e321c7113b275e403e8cc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 28.4MB
        • SHA256 7d6560916521b4ac4d43832b8d8a43bbd859f0bca847f3b008862c35dd41cefe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 28.6MB
        • SHA256 53291c0253cc85148baf3470c8ccb27e5867123bd12920be6a0e2094ac2a278c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 28.1MB
        • SHA256 5e3d72bba55c4111faff366bec69f387cc2862c80adca2dfa757b7600079d18a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 28.1MB
        • SHA256 158c41e01aae9b544a0b06ac027ec871af17c216dccc443e379e6255910c9070
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 28.1MB
        • SHA256 596ede26f2f7411fae16b4ee2960a20dd16a40cf22fe0206ce1a53da3165a986
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 28.1MB
        • SHA256 1ecbae5fd36764504a0a85d19ee6b6aa8e6bf40f96ff404567f995ce7dd722ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 28.1MB
        • SHA256 7b18eb51fa51af5bfbcc71d5d2505fd816eff1ef297c13b78670cbc129cbc229
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 28.1MB
        • SHA256 edb818265ae0bdf2caedbdc86ce21abd4c0f73b2af3235f69d19aa443914984f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 28.1MB
        • SHA256 5746b2267b29e07bccfe372b610db4ccab39a0fcbfb10f6ccd22a52ce9263563
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 28.1MB
        • SHA256 6196abbb7713b252123816213b3d1966fa3ce19323a1f32b50d44743b519c31a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 28.1MB
        • SHA256 0190cedffa135e6241b863d8236106feaf9687583a55c81e5f63a4a9b36d26c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 14.1MB
        • SHA256 a666d1349c632728cdbb5721f6797f25ef939af37ea5ce5f994824b079b17daa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 28.1MB
        • SHA256 00325c729ea6d3ced1ddc396e2cf4ec4e8d523f386569fbfab9f5a49ae6fdb04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 28.1MB
        • SHA256 9a050feb4f8d7638263bbbee7bc4ed83cc96e6f7d69f3e7ae5107ec984661390
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 28.1MB
        • SHA256 096cd8b01cc79ca14fb3ee9ea2dec58301f2a06f9067a252b23700875b010b92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 28.1MB
        • SHA256 e5aa60fbeb1a3b7aceceb3d22d8677feaef1cbd479cfc36ebdcf396f5968e9f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 28.1MB
        • SHA256 4c8651b9a53ecd301a4e7bb0ca5cc5f46de47d39c2f6683c0b23746ffbedaa14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 28.1MB
        • SHA256 cd0feca687e4ac01f6f1e6db6982468112e1e10eec305dbad19cfd93a89997bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 28.1MB
        • SHA256 27a5e07d2fde8a871fb5d5b878beb1f25d746544fcce40fa7261503b5fdee852
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 28.1MB
        • SHA256 3643ed5393ea434ac1049a03bdbe4d12fa12c0d855a6fd5175557d6ccf3a4c6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 28.1MB
        • SHA256 9a84809d6aaeadf94bcc5e4f25ac4c1142b12a3dccbc47dcb172d1025ab21676
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 28.1MB
        • SHA256 1931ce858347789a4d9673691fc583d5e25f2b10a99948d459e5d1510d097447
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 28.1MB
        • SHA256 197261b509f72d8738a64d6a82768fcf468c81ab2f512faa8d7a9962401e7017
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 28.1MB
        • SHA256 99b627695636622a81d24e4737948040913ea5a144d9263b7406e0e30c05a465
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 28.1MB
        • SHA256 6889789fcc3b29bb60346a36fc949fd637946cd8294349a500171d45ec31629c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 28.1MB
        • SHA256 e07570c38a88e1cbf01e687d38c026ff6b48dbffd53db9abb7bd2d13910f8d61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 28.1MB
        • SHA256 7dfd51f6c9c92f5b9294f2a7bcd10849cb2d4980a3181752ee88874d99ce366c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 28.1MB
        • SHA256 7b7500c8759d336f98efd3e9cb6140bff89e35ef5c1307a489e15fd5613cdf4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 28.1MB
        • SHA256 2bd08463f9eb333123fc688ad0cfdce65d0e8478b9c17f25c9371c75e02b1122
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 28.1MB
        • SHA256 24d769f6105eb20f1ec8d052f6fbd289fe6065d218873732fb303cd9a1b07b81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 28.2MB
        • SHA256 c691d1d687b636decef8a99371391eec34734beb2d41a6a7162fa0409c2daa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 28.2MB
        • SHA256 5c4523723c3ca15b25b295dbae5698c3e4941f52629d97c1228056d6d85ec276
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 28.2MB
        • SHA256 7982e5ee301a961bbeb874d40a96e5f10ea20f5ea2eb2eb79fab9222ac31d31a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 28.2MB
        • SHA256 2824423b4e344f093f54fb5dde3722daa6d6c681abfb660f6ca98e947638ebbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 14.1MB
        • SHA256 9d67efd9d21c68ae3a32c94c99f54a4821869e507c45bb925c5f2e5dc4893eac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download