Overview

overview

8

Static

static

3

2026-05-22...wk.exe

windows10-2004-x64

8

2026-05-22...wk.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    22/05/2026, 15:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-22_0b6a4d4d58d14b036346c4668fc546a9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 17.4MB
  • Sample260522-s963eaay41
  • SHA256 287aead4353dc829fed8f991330164bdd3e6f898e2f010b12c021db9eae8dbba
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-22_0b6a4d4d58d14b036346c4668fc546a9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-22_0b6a4d4d58d14b036346c4668fc546a9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3984
  • C:\Users\Admin\AppData\Local\Temp\2026-05-22_0b6a4d4d58d14b036346c4668fc546a9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-22_0b6a4d4d58d14b036346c4668fc546a9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2180

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 17.9MB
        • SHA256 67647f77c390bd1ea39b4a23d493dce5b3005d271f60675a408a354fbcdd1ce4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 18.3MB
        • SHA256 e40f843dd4013260baf81aeeea6f5e2adebbad70739f44950b16175cab6489f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 18.0MB
        • SHA256 37823b1cf2ec3138ab04003608a2fb21356964b87c91333002d7f366e79a3142
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 21.5MB
        • SHA256 2d261697963a1e92e85d5f546cc7b2e404f5a74f3c5cb43e0b9ff61c6c779f24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 40.8MB
        • SHA256 961d88f442a8c389c99bfc05b51ca2ea8594b335d5a484087b58da0ad28cbae4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 34.8MB
        • SHA256 fe5c3041c94cf8e8453e2a08e6d63a81cee7604b7fa37f3f54b658a28b245dac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 40.8MB
        • SHA256 7a6b00fc6e3ac85dd526b138dafd754fcb70af3390ad159c921a5ea28f249c28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 36.5MB
        • SHA256 a80f80459a49bd1ac86d5c7b6c421c66ff33a7de71690e6919c6a12003200112
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 38.2MB
        • SHA256 d9afb870ecd7e0c8b3307c24326c5126d88c81b2b385531565770268fc7fd837
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 37.0MB
        • SHA256 df93ba71161a53c4485ccc8fa103ab85263bd7ef887b55bfee708df0652f110c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 36.6MB
        • SHA256 da0a061bb5b0ef5aa0bc889d9c889759bbe23e864ef7b708f52a62b3b465c8c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 37.8MB
        • SHA256 7ec0075c3266234056af1e9a4c34e4f94735e55595a378c332b358a122ba8fa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 36.2MB
        • SHA256 72ab0c9cf9de18e70dae9a22a1c092869f883c44425ecf5a29800322248815a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 34.8MB
        • SHA256 cf74d0cc04ea0a06db01f63b7bd276aed8039ad0e0bdaa119a48383f51124e67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 34.8MB
        • SHA256 cd615e4ced1fb52dfe53028a4df5d5870eac0a2b9b365eed82cff5ecc7b6ff18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 34.8MB
        • SHA256 16a545a920c2de1cf68542c34b3516992162e6f92f44a6e6cdd6db9f36523012
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 34.8MB
        • SHA256 517394be69c75b4f5b330a0ec88731ebe989bc4c74674abfb0eae98b4d1e7a10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 34.8MB
        • SHA256 47b4b87938c935bc7aff6b5c8d1d4d8ed84799b9bd7f2b929fbf306ebe081c86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 34.8MB
        • SHA256 50a82ad61357ee20e4510f0721adbf6be84817f3bbd4bc8265e0b2a7a3b5598c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 34.8MB
        • SHA256 610b783203063038c08c986ec944d85d2af28cb88fc2b962b1ba153709ac7abe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 35.0MB
        • SHA256 234a4cfa2ba77061252d36e0e4c56b6fa4dd35f07497c2234ad2a1effdab669a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 34.8MB
        • SHA256 a89b47f296ee5fb653dd787f3cf94c11ef6949beb88b797d607dcd62d4664769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 34.8MB
        • SHA256 0c9709731a61a493548c9938474a56ce49b540edd0c888e5cd8a4614ed9e071b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 34.9MB
        • SHA256 b4f652746b2595c8eb4757420a14aa62e0dfc3d4c478d5de8462e2833aa0db3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 34.8MB
        • SHA256 ca7e8084e1c93c4525f85bb35ea1dc9a90f3ff16d23a659e698448f5eb0de591
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 34.8MB
        • SHA256 a1cef9dbcab7b7c911ad5bd614582f2e46f92b5003059278a231a358d6feedba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 34.9MB
        • SHA256 5cd6d574519d53dd40acb319e1218e2215425e4c8ecf2b6d24f3c775eb7b6536
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 35.0MB
        • SHA256 4ea939a9b22f4827be7a29cabe65ced71caccffa6ddbf0ed36d2c76a6bf84fd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 35.2MB
        • SHA256 efc30ab0579531f5d9b5a08d6c539e452334c797613c82769128a58bfa5c30ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 34.8MB
        • SHA256 1ce3325f42b1d6895bcd22d2b707667c8d897d6348d5939971fd9be071b3193e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 17.4MB
        • SHA256 2fe7ff60b70021eb5af63d04ffaad14944be4a205547f11d0f81b6af3a26c43e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 34.8MB
        • SHA256 cf4be83dfd187e70f157755ffdd9690b44fc937b41e6460857ba18d7535c4ea9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 34.8MB
        • SHA256 7a67090be6f6f5e06a2a040fa29f0235181b9c6d09dfa171c078e0d153dab7fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 34.8MB
        • SHA256 fce5de49ee29d2061982f50a8efa94802b7fc862fb72e417c0e83a99297b388a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 34.8MB
        • SHA256 e66b0f497162b3a7a5e14bf504d65d72c67061baa06b2f2d60dbd72181d487ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 34.8MB
        • SHA256 cf459720a209e5b08817c80239ad3530b69c550d096579358f63bc000acc2b46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 34.8MB
        • SHA256 71196a0207635fae9ec8810b71f6f110fef8cc467df872a6c541ecc25c505e12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 34.8MB
        • SHA256 bc1d79b0e873f4e60da15b955843182c3034f3ddaeaf51544c923c207e8069c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 34.8MB
        • SHA256 6256cc3a5735a05bdaa0a2ba7517a1d7caf0fb8afe8228c2017c54cd85e1ae51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 34.8MB
        • SHA256 6f1dad2591e773066cc1eeb6bdf25c2b36e055d7737aa0ffec494e8bbb3d3d8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 34.8MB
        • SHA256 6b9632073580d8870c03bb4b78ef2365f4b6116cf9715cd35a6b15c748f78f41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 34.8MB
        • SHA256 36958fb740273e5d23bf4fe39851e1376b8496f7eaec8e2aa59046d555882439
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 34.8MB
        • SHA256 249e91d02aa668ab4ca1f66f62a6fe897da95d4047d98798ab22d7c5e88df3cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 34.8MB
        • SHA256 23b16a797e5482998d3d9fcdef2a57d1d886abd07446c4b017f53d9eff10035d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 34.8MB
        • SHA256 6448ac4c5ec001ba0f184d870273109e5ce5f8699dc61ce6978f836e7d0854f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 34.8MB
        • SHA256 8239166922df1dd78cea6a424f1edcf83f7c85d065c0c8a4621f8bcaae7c9c6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 34.8MB
        • SHA256 a81f46f49f4c996acf15772b781794170239fe431c44daf5f28f688363bc479c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 34.8MB
        • SHA256 9169aff98f9e66e731e0ed2a0cec4f0fab5bb010cde9f3cf3e1df213318431d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 34.8MB
        • SHA256 e5fda8211485079f375f06957c86da1708de06e25ce7c9b7ad7e4cfa7d5568e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 34.8MB
        • SHA256 d6d84b60d431d0c6d641f077eebba156dfbf92dcb8e9686b33347f4d531ee88f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 34.8MB
        • SHA256 65dbe7edb340c4d898a58d527964d0dc3b1fb07cf34793f28f1191847c223287
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 34.8MB
        • SHA256 59b87bf14ab454a9f860db375ead027556f50978b282a69fc998eacd9955cf66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 34.8MB
        • SHA256 7d486a600cd46b50ee1adfa642d1a0f4a552e477ef5b0e95ae5398574b98e232
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 34.8MB
        • SHA256 16883099a04c07773b2b3487b3bc4feef611e3dd155e06520575b253b777d229
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 34.8MB
        • SHA256 b0d215c8568397db5abe62f85f7bf396033eba074d4b49b82a8a3a4b94e9d0bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 34.8MB
        • SHA256 6d71e7e693d711780d95236fe9ccc6d101989829d00dd3b7e5987006bd066c3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 34.9MB
        • SHA256 0152f3ecb046087ae1a7a6f4b82b06fcd694c8a5ce041adb7363ad2d04fb8f7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 34.8MB
        • SHA256 f6ddc6cb033d35efad20c71caf676858917beb5b85738091f242aeb07707868d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 34.8MB
        • SHA256 1de8a5c02b29fd595be3a023dd3218dd13e35d988cf17c68f1bd63d8f06853ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 34.8MB
        • SHA256 b05d651f4165257c18e426c1c2859ed7dfe541cf4a03639d8f06d7cb36e2a3d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 17.4MB
        • SHA256 287aead4353dc829fed8f991330164bdd3e6f898e2f010b12c021db9eae8dbba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download