Overview

overview

8

Static

static

3

2026-05-22...wk.exe

windows10-2004-x64

8

2026-05-22...wk.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/05/2026, 15:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-22_0b6a4d4d58d14b036346c4668fc546a9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 17.4MB
  • Sample260522-s963eaay41
  • SHA256 287aead4353dc829fed8f991330164bdd3e6f898e2f010b12c021db9eae8dbba
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-22_0b6a4d4d58d14b036346c4668fc546a9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-22_0b6a4d4d58d14b036346c4668fc546a9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5076
  • C:\Users\Admin\AppData\Local\Temp\2026-05-22_0b6a4d4d58d14b036346c4668fc546a9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-22_0b6a4d4d58d14b036346c4668fc546a9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4060

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 18.0MB
        • SHA256 37823b1cf2ec3138ab04003608a2fb21356964b87c91333002d7f366e79a3142
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 40.8MB
        • SHA256 436ea5be10450b348299680669fda39305cc045323d81f468ca8a8e9f5189bda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 35.5MB
        • SHA256 68a6f11e87cdef145c5bdb059831ef52bf75653936614726afcbce3bf7e26a7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 35.1MB
        • SHA256 b66dd346031ecd82ccf225ac23645649a87e6b9c938b8a7aa4f44e3d08adecb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 35.6MB
        • SHA256 e37c3921b3a4ba145ea3dd4a3200d8e237512713f08df5798d91677fe72abdef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 36.1MB
        • SHA256 25c82bd2caebe669b4f12dbb0a30ad6c297d82ccfe4124efd404ce53de285b05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 33.6MB
        • SHA256 7dbbf75bb7cb8163709e4915177db7192f0ebf6bda12022c8140bcd34ebffda9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 34.1MB
        • SHA256 e0b951f67a605bd85adcf41ca8fc3da7ee4a0f555acebdecbe102a8699d1b04a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 34.2MB
        • SHA256 fcb7a416b30d5e3b664e8cecef9d511cb463dbf592d7cde24b4d4905f7dbfd22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 35.6MB
        • SHA256 a9fda214641b7817509108afa112abc3a9e6d891e25079771a2939dedbf4d240
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 31.5MB
        • SHA256 ee2e5481b9eb66518bfb13c654b35b5bb485dc4db81a3721f62de2135e6920e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 33.6MB
        • SHA256 196accb93daae617649ee2012fcd7c3bb9557a56b33d93f6c61572289c2c94a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 31.7MB
        • SHA256 717095fe799965b7fcfc746b5fefd0c48fa1d50b62ca4ec468b8051f9266c349
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 34.0MB
        • SHA256 d1ec6bfd02f3939c0ab1041f1c399784e66e5c1c488c78ab5586e012c5a8b5c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 34.1MB
        • SHA256 6d0b0701c4bd24553b176f26ea615d6594b317fea4d8623b963267c6987d6556
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 32.9MB
        • SHA256 8290ab3d72c70b0f81215a5d8063f2dd9dc991f19b2ba566d4669b5c532d62cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 33.9MB
        • SHA256 242acf84987155f5bcb54b5ce56a55868d2dd178912a5457456e50161a466d76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 32.6MB
        • SHA256 15173e781b3d31d8e5d3136e87239c3eb9857eb1bdae8e2cef1d683114e1049f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 33.4MB
        • SHA256 fc1aefcbe5cabb61c339ba4803ef1c107e1ec9b156366bbc15b9ef8dba3d2cf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 34.2MB
        • SHA256 32cd38ba0fd0174de6d360e1df1d71abe9e1c84dd415ffc4797a917323274848
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 32.0MB
        • SHA256 a622b01e191ed6f70210dea4f2938e227d0a06cd723eec7dee2015472504c621
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 32.6MB
        • SHA256 43e6428f3441bb295bb98d1d4e8bcd10258973e52214d71e70d6232ecad313fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 32.6MB
        • SHA256 d277acdd241715292394f3c8d41b71ba9db5461f6a72a823b9539c4f6a64a364
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 33.1MB
        • SHA256 f46a4973ea009d549eeeaafe73fc71ca60256de9c850cc527c187cf8bbb9d0f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 33.1MB
        • SHA256 b65e67a16d43147f402b247bebda681ccd274968699a03dc7bbacb75171e2699
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 64KB
        • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 32.1MB
        • SHA256 ac557877ea149c38f489ed74f17e22fea33c5b069c4c81d753eee532b3dce275
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 31.6MB
        • SHA256 08003a0b4f2c4b120c1fab299a361733486feb961e7db5487efdca6387bebe87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 32.1MB
        • SHA256 9c059025f1b747c37149c8f452a7311a8a31835f3df760ff0f2c51683589abd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.4MB
        • SHA256 2c83dd0edd7e9479bd85d128dc38a00ba286b74737d9b00fa0c9d946a15534b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 32.4MB
        • SHA256 87787ba9b678c45a713023c0fd2b14fc66da6f5875b77375c492b57a86c72cd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 31.1MB
        • SHA256 50e9e0faad633791175dc0b94e7b6d1c71b7f3d1b73728fbb7d74c1990da8e85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.3MB
        • SHA256 a5a0cf3889fb455cedf855477150f48217d30ae3ef84a3a4df7a36ed353fe4b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 33.9MB
        • SHA256 7b315d32b4907866f2c8da7bffe2abd0b383f67df14453a91872d7a9d783eccd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 31.4MB
        • SHA256 6e56e19bc2b72aa812382dd029b21494506f1aeb2a0eea43b7bd781e8f0c7ca6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 32.9MB
        • SHA256 01336f69c07c429d24e260399dda46f3e871ef7328829bb0e03783a0a639ad85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.9MB
        • SHA256 5727f6094039422c2e65df0adbb6e01c3990e1536557c64406f14ba771fbc51d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.3MB
        • SHA256 f4076765bc40623743116883ed8d1a77c617f580a7d66bf2df00113cbad2c660
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.9MB
        • SHA256 9ecc05af70598f28a4aeb57ae846800b78d9f24bbd7573a56942605cdf5c7f4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 31.4MB
        • SHA256 8f374711e0b9a0c9654a19907adf111f7ab700f05b92ba6b16db090b66940111
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 31.9MB
        • SHA256 0b132bc6637fd1682f7a6824965d2b0bf4c3e1fc1fbe1cd9f7700ec451ca1b52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 32.9MB
        • SHA256 2f6b4a631c658d54806de4fbdd92f65bb9da709b0713ff1319e78361e3ec124e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 31.2MB
        • SHA256 b8a4399d5eb021cc02f2bc101ec9688b257d52214f90a1d9e8737a89953e968c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 30.6MB
        • SHA256 7485f98b67c7b760b243f3a2910ab4d550e72e726256780e0cab45312709e0b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 30.4MB
        • SHA256 3a629c33935f101f3ebb963c65390bb883a0a886ebc4338f3103f8abe3d536ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 30.9MB
        • SHA256 974e2240dc361d42bf51913eadf8f16e5abc07f01f1fc41b54d17a585c659747
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 31.9MB
        • SHA256 9d42d872f90a03dfcbca7857ed1dcce766a8d38cf8776e0a74b1f3d256fbc6cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 34.9MB
        • SHA256 0152f3ecb046087ae1a7a6f4b82b06fcd694c8a5ce041adb7363ad2d04fb8f7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 34.8MB
        • SHA256 f6ddc6cb033d35efad20c71caf676858917beb5b85738091f242aeb07707868d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 34.8MB
        • SHA256 1de8a5c02b29fd595be3a023dd3218dd13e35d988cf17c68f1bd63d8f06853ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 34.8MB
        • SHA256 b05d651f4165257c18e426c1c2859ed7dfe541cf4a03639d8f06d7cb36e2a3d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 17.4MB
        • SHA256 287aead4353dc829fed8f991330164bdd3e6f898e2f010b12c021db9eae8dbba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download