Overview

overview

8

Static

static

3

2026-07-05...wk.exe

windows10-2004-x64

8

2026-07-05...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    05/07/2026, 04:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_c329bb613abe57095e1317b3a59f3ad4_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 21.0MB
  • Sample260705-ffmepads6q
  • SHA256 6d3d5fed064e06c95d55bb2a94de6970a5127650b4946bdfa4c66b86bb6c5468
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_c329bb613abe57095e1317b3a59f3ad4_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_c329bb613abe57095e1317b3a59f3ad4_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4976
  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_c329bb613abe57095e1317b3a59f3ad4_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-05_c329bb613abe57095e1317b3a59f3ad4_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1768

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 42.5MB
        • SHA256 0bf998f3287747a48ebca9ccd1680fb6e0e072e3987a13be4888e51b372df862
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 768KB
        • SHA256 32a4edcc850e91e49004e89b1caaea00d041d8b04cde89ebaa58552b8c82481d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 42.6MB
        • SHA256 1939eeac4c3b3a7f20611af9c906c677debfc621c323b2b63775f449f46aaff1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 42.0MB
        • SHA256 5b78f27835bab05c675d55489cb4fb3dbd7c4d18228e78092c470911cbef3d1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 42.2MB
        • SHA256 e92f4a88de6cb9bb3d59c170c74bcf08eb2add7e36f5a1a713939cfbc5f48091
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 42.0MB
        • SHA256 415855ba6d7ad3fa955d3a5dde24a7fbbf1ab8d6e835f1ee0e39b9cc0426d856
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 46.1MB
        • SHA256 60fe9ff94cbc3b0abc47e8aa4dbd138852439224c8eba0d4c48a5c7a437d83ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 42.3MB
        • SHA256 85dbf0f7adb371cb027533c82b0f722c5469da6411a341e6a8b6c8389aa9b68b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 65.4MB
        • SHA256 b006cf2588741123bf664c8f04c82bf677106fdaf83a92de42945b4c216a326c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 44.1MB
        • SHA256 7ccb1c36d48ece764933f9928dcc9c5e82cd7c45b495fa21c45d3bc7598cc620
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 42.0MB
        • SHA256 9f98d17b7328e22bba20fe5fdf4d9ee0acef35021b64606859a4c90eb3183e36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 48.0MB
        • SHA256 b522605e931bfe572ab253872257fc973fe66037677503885182fc94dbe50bb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 43.7MB
        • SHA256 c0c201dc5170c667024875f31eb96b457055898af327482afe535b9b1d164280
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 44.2MB
        • SHA256 e88064bd439786a50227ef60f6460fe7d34dcb08089cee270174b867e0582489
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 43.6MB
        • SHA256 74b038674b1ca14563e3b3761a9a4e328551c1ce76f7ed10c99e3278d04d3f3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 43.8MB
        • SHA256 0a51a8fa21a58b3b32996266ea5a19076448a1def8ff32863edba0a55695f115
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 45.0MB
        • SHA256 45dde45d6aa105c83d5fcd8cd9342db5127b76bef1eaf5eba2f4b4a6545a698c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 43.4MB
        • SHA256 99c3aaa66e7aad4b2a894b27eeb5d33567797a4ce77d551c3e18d0b63c632893
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 42.0MB
        • SHA256 f49299c8093de5871297b90d1f2ce306da462176a1b5e963a5b313865bd5476b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 42.0MB
        • SHA256 9a817ba7f31a9095d78720129f0946eaed71ea8710d63eb27a8b62c2872c215a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 42.0MB
        • SHA256 245784e0dd3cbc5474c6e82236025d6a82bbd26edc2967ed754f38c1a9b3623f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 42.0MB
        • SHA256 f5bdb5850ec9b7cabc4e7350932d5be1bfd71fda6310a960c0b5c153d6c451c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 42.0MB
        • SHA256 0a33800b5937fa0ebc6859a11421f39f5e2cbc859978447708279b4d47049e77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 42.2MB
        • SHA256 c415ef9bbd4fe5993322f1f31d53fa3fe8a70bcc34b4c2a6fffdff0dcb510b46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 42.0MB
        • SHA256 f5bc8cdbaa56759405550bd2d3e963a07f054d77b22f5b54fa2afa461fbb01ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 42.1MB
        • SHA256 60564eec35532c0f1ff11d84d8a097d907b4408d473d2d816078a86c8ac8eaf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 42.0MB
        • SHA256 ef39cc49e3e35945f334aef86fce9874a55c3c7dcf4e171abb7befe6a5d39635
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 42.0MB
        • SHA256 da78f5bc4eb55bba77c13a0056d433e84a1f8b54da38000afb3be15918abea74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 42.1MB
        • SHA256 effe8024037fedc6912eb0c90666cfa9796ec292d06d863e5ddc41c2c903fd0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 42.2MB
        • SHA256 fc007e54a42cb434125ff681bd0b7ae73560901a06cd60493d15b422b02e61a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 42.4MB
        • SHA256 6b9762bd017ce024b1dc75bef02f122bc25f1ed6f6f9099bb2a946166c09a9f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 42.0MB
        • SHA256 645c40767793a95bca0bfcb73580e80e15f4dde4b72b801b20e39a241d3d7e3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 42.0MB
        • SHA256 6c256782998dac7cedd0e78381f05292fe1b3c378dd814f168a5dca253bd2f85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 42.0MB
        • SHA256 fe3d5534c2932f6d8c811e1ad7138e2bbee574277400b2ab3a8286fb8fd7b37c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 42.0MB
        • SHA256 35918f711e6e0df9ec0ee7bb18fa4f70c9f8e8ab4b400ebd4d3a49022007100f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 42.0MB
        • SHA256 1c8e5179f392452fd78155113767e7a3be771a8d1a49a7f0c223604ef4b4cf5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 42.0MB
        • SHA256 7a73a99dfb958fc96ebba39f5ad65c1fe57e7bb993e65e6013f8c34e45c0afd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 42.0MB
        • SHA256 06c9b7e84700a471e07c768d76c5b8269e485dde05b4f132d9bc6370ccc3281d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 42.0MB
        • SHA256 1854ec23b7fe3e03994aa5b76fdebe48d450ab85ec0cd5be8c1eb45d0b0a9a4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 42.0MB
        • SHA256 fc03b5a6d604cb4b8c5eda834b06d32e6a388cd83b021caff021b2735deea178
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 42.0MB
        • SHA256 76765a9910d60de2ee0554333923dd7708db5a50d668c372b9959f97bb344dd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 42.0MB
        • SHA256 0069a4110da095c2d65d8c903e6b59b668b6acca8222ada46ad012ba2e7dff7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 42.0MB
        • SHA256 8b6509f155258e28a8ee17279a3d04aba656642dc8e9b4a4b7ab418a28a22925
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 42.0MB
        • SHA256 f7d2d8623266b478bc873285804c4c1ab8501f40b737b4604f2fa8cfbc4a5dc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 42.0MB
        • SHA256 bff7ac16d667ffac22ff1adb211822b2b9c7139d11274f530096b1cafcd5f58b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 42.0MB
        • SHA256 deb6de06a07a626ff81d589e5ec3505c377c1c111af642ececdb992f5a1a84da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 42.0MB
        • SHA256 3724e6ba353f0f3113776c7e746ba448592d0e8f328c116be84e357123388b64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 42.0MB
        • SHA256 bca19563ed414c0053a9aeb423952ceddeb6b36caf3e456da8b1d42c394f9c53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 42.0MB
        • SHA256 570cceb2adbdd2d61cfd76acf0a6554deef3198ce9eac865965958d65d0e628d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 42.0MB
        • SHA256 b596a4c8d447e48db33ef40a281dec020304b0fab527ad1f64682d1d9fb0e1e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 42.0MB
        • SHA256 6eecc2a0bb377a2f139e7be95baa7fac56d1dc119d2815603014a41c47e0c6bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 42.0MB
        • SHA256 1009bb8f173db54c790023e438c5ad2a2a0076175af9fb59ec0d81195afaea2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 42.0MB
        • SHA256 720982b290239107eccc48653fe81ceaf5d564675d92092e37665baa92298df5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 42.0MB
        • SHA256 2e85fa033c17ae21fedae497bbc9509e5aa39d1c6ee6f9cf691713a1ea3dc562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 42.0MB
        • SHA256 c0a5e21b7f38b14dfa9ed99b02fab89636dcc8b39cd7d796778c51b8fcdefcd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 42.0MB
        • SHA256 ffe40d915211230ea6228bb21338b026cd4a31909db8e08ae3f8d30f35682a6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 21.0MB
        • SHA256 6d3d5fed064e06c95d55bb2a94de6970a5127650b4946bdfa4c66b86bb6c5468
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1768-24-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4976-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4976-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download