Overview

overview

8

Static

static

3

2026-07-13...wk.exe

windows10-2004-x64

8

2026-07-13...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/07/2026, 00:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-13_bb4586082a02b43b3188704feb3db6ae_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 4.1MB
  • Sample260714-a2x6esdx5s
  • SHA256 27ff01451bcde56473077c7dcf5d0236b79a09c5da9584eea472708a98847d8a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-13_bb4586082a02b43b3188704feb3db6ae_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-13_bb4586082a02b43b3188704feb3db6ae_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4160
  • C:\Users\Admin\AppData\Local\Temp\2026-07-13_bb4586082a02b43b3188704feb3db6ae_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-13_bb4586082a02b43b3188704feb3db6ae_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5972

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 4.6MB
        • SHA256 949ea2744c870cfca15a8ff1d6d4d8f6c423be76e8799b2d24b632655fb37c91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 9.2MB
        • SHA256 7521df07919547a4a9226c5be7b10c7d665a5b744191bbb4857c4e5129c168a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.9MB
        • SHA256 cd1fa6fbf0ca21d3460766803aad33f3c49f3b74a500ce40fa5fe0dee3fff928
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 8.2MB
        • SHA256 a10a4210153fd7821484734195eae9249dc0d725b64658f8e6e050e601a1a87c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 8.5MB
        • SHA256 a73582d23b13038cee496e18512a7f2f73f033d1e354e566a8f7b7dab3df3443
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 8.3MB
        • SHA256 0f23928e358f8249fcb4228193b46164de0d6ba8bd0307106d4e19f068e9a4a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 12.3MB
        • SHA256 9e697b8885315ac69d50c9d2877ec4a200baf286c845fca1ed3df06bcc3b3883
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 8.6MB
        • SHA256 3a138d7dbcb7c82cfe676cabbcd0daf9407a406f5d457cd291c1e543d7324f46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 10.3MB
        • SHA256 0c01fb8f8440af26b743f92a843439bfd2e16ffa230aac0e570799f7649577c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 8.3MB
        • SHA256 4ac7b7859d3028bab4d030e020cc3e27ad31be8eabada98d13dacd1bdefdd5f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 14.3MB
        • SHA256 a58959193521c3e6ffbcc654166773a72b4a2753a8f15f3eb1d3bfabe6b7e895
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 9.9MB
        • SHA256 832542c79b16649ce8d0d9a5191ea49490ad99e2b16a5ffaed56611c716cc357
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 11.7MB
        • SHA256 f3d4c79b5e34a4ce30619a3acdfba932e1ecb0724fd81ac4cb0a444b5e311a27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 6.4MB
        • SHA256 40079917c472c49e9c9547b47287b64b28f2d9cd0d1afc9e7ea433aa1d611dde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 9.9MB
        • SHA256 94b1cb55f5b8700de552654b95b2a8e8183f8a0a97a3cb6440d4cde9bccac678
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 10.1MB
        • SHA256 45b6640fba213705834e8bdd6e3050d59672e552d2cdbdad7ac41b9c985c7e46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 11.3MB
        • SHA256 8d9bf708c2ce70b502137825c17f73064d8793a73687152d45f364ca84a6aaca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 9.6MB
        • SHA256 30d9e28f3355c598e8eb89825cacbae15ea40e4c6d3d313e3b8f4f3d596c9301
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 8.2MB
        • SHA256 cd436fd943c46c363da950b59cef317735b291c77c937d15bfb1b137f7b266fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 8.2MB
        • SHA256 76e98af6fb9469e06c07b690d81cc5c9c494915bcd27479c24cc625481b72431
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 8.2MB
        • SHA256 841eed1ff94d6aa71adc3c4fd9adac6e5a20f4992ef1c1ad9ce52ce995e2461e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 8.3MB
        • SHA256 398763aa961822df1299af3f8bf05d8aed41d4f59db98011bd5b68a23a09d710
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 8.2MB
        • SHA256 d9957fc59032fb0843e0c91801c236bb2f9ac3eac892826faa295bb96db884f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 8.2MB
        • SHA256 d437cbd32a3a74cf7d0097ce21cc9fff8183ef85ef9f9a9badf65e0fc02fff9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 8.2MB
        • SHA256 e5f9d5bde19570e12b7e73e156abc9e6d32c9cbd532ad099f4c8d35adb0fcb3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 8.5MB
        • SHA256 3a70e35cbb86e119a538a9bcb77bfca2049ecabe0eb16f00ea6c98553ef4653d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 8.2MB
        • SHA256 e4c646dff4b9261f714d70084f417f0a35ed02d1d8485bc4352a18f98cd42c94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 8.2MB
        • SHA256 f07806d505c8163233fa1ed25aa9774b53876ad60a530b5380c12b9811bf04c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 8.4MB
        • SHA256 83a7d98c314e79a0b70257369ae7790ddb371881b4d28a80faaf7805539ccea7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 8.2MB
        • SHA256 5d0b7f1597d1e6c91a6494e9ba21e7a86b8b8421ec2a6c9a06690cf7d48c7489
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 8.2MB
        • SHA256 f0742f8cf4f1439501fae99a6a0f795d6654d535aa7181a0ebbc91754064718d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 8.4MB
        • SHA256 af4396699df58a1834d365f5f627a49b2393a93f108beb2aa07c6bc6fda7c68d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 8.5MB
        • SHA256 b6ff30a65d7eb736cc9a4ea68409e735f92bec6057a5a8e97da9b477f8447ce9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 8.7MB
        • SHA256 672c722b0f783d7b33ea1437eaa3f4d3d7c1c5a804b35b279800940607189026
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 8.2MB
        • SHA256 a0bda9626ac7cc6bffa64e06f867cbbf1d08de75764fa0a7fec52285c339a72a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 8.2MB
        • SHA256 f51181ad5abf597d82a891ac1b93dbaa2af54f7cfd0df6ea96cc81df011d5c57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 8.2MB
        • SHA256 54738db3099d36eb21b5acc5da3b47035f7c1f375ea092f8eaaee87079958ba4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 8.2MB
        • SHA256 b9538e15bd4b5f7047a0a0c1e3f5cb4247afce354b25a7ffb34cc28df30edaa9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 8.2MB
        • SHA256 c5b2a5dfde80ab4e2bf03a731a816dc3820702af0275bd3c775900eaf815ea0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 8.2MB
        • SHA256 dde4eb52bb21660d8c4dfacdf14c4e513d6c448e381ac747068fce975e038b05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 8.2MB
        • SHA256 eefcab708718f374fe3b058e1e8659c6dc581cefaa1b88fc862996ad13ff3e1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 8.2MB
        • SHA256 095c621f5f29d4d8daa24290c6ee31dcaedf45cc2c16e01c2709bcd530ec9060
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 8.2MB
        • SHA256 fbf77ba98e6f4d89355a6c1600749ad184a10315423406e26a0d50d9bac7565c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 8.2MB
        • SHA256 be343142dfb8f7a7db8fab42885dba6cf63cd197477a2ebaabdedcbc5262a536
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 8.2MB
        • SHA256 8baa9c16e9c0dfe9f3f44b938a1dfc2642cfed72cdcdd64ce420b36ee47db089
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 8.2MB
        • SHA256 3de877dc8ddc9155221b31197f1c31b813049a420a62cf4226409bee1b14d452
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 8.2MB
        • SHA256 b7e879b6eb3012913ebf1413a27c931c71715d2f168926bee385940b093e6ecc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 8.2MB
        • SHA256 7da92d71da20c9593f22cb991233aa60a033bf6353143fe4d66005576594a972
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 8.2MB
        • SHA256 6d25707706d21da68580ff4a7932d2dbecf24f34c40e0d08c1e3d3697fc90363
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 8.2MB
        • SHA256 1a322f026f4f14be0626a4517c4b245b9c7cd290ab6ac6c0cc91a59513daffef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 8.2MB
        • SHA256 ee485b25bbaaa8c410b6d64f463b0d43dc5e670c5d1ccb58d31d5f07f0a3083f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 8.2MB
        • SHA256 0639f7280ec99e875772579ca8bec3a752ef0397bfffd8fb65cf598ac6678849
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 8.2MB
        • SHA256 601be1873444df464fb87d0ac3c004734275812923ac3a446b9d3b8f4da1a42d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 8.2MB
        • SHA256 b3a5368d46bb92def2aad6dca0b1650cb80b884f84beab884d02e97c0c8b62e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 8.2MB
        • SHA256 62bed96b6aa0cd657217f6b7c22c7bbadab5cc9dce43ddfc36eb41c305718b2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 8.2MB
        • SHA256 240c5cf8ee46e33e7823ed5d1dd2c91a6aa6e63497f58587add22aaabcb5b32d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 8.2MB
        • SHA256 8057f35898d1257b0c8eb01bf4819197b25e6c9bee272013a5a61b8cc2c3fc27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 8.2MB
        • SHA256 2267f40f69f7415764dad753f019e7cef4074aed5d366524e8fc7cfea5a938fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 8.4MB
        • SHA256 984924ae4b5bf9c1af68fdfda4899a22c56c4dfed4bb6be0c869c8a1047df727
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 8.3MB
        • SHA256 b074629690bd4d1f75df90a0b3f2523b36418dc32d8e8a4f857118d8f0cb4847
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 8.3MB
        • SHA256 6e34940011d114f1a86e5c49274334f3b387daa6a13597cd06058ba9ef6482ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 8.3MB
        • SHA256 8f5c3700d165dbdab8ea548130095bf686baba2443f605ca06c6d21fadbf0343
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4160-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4160-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5972-49-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download