Overview

overview

8

Static

static

3

2026-07-13...wk.exe

windows10-2004-x64

8

2026-07-13...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/07/2026, 01:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-13_646926f67bc638d81556b99a6a2bc451_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 33.6MB
  • Sample260714-bprcsab14n
  • SHA256 ef4964fb2ab1e78a456da875edc0b9aebfe89eed2bb0d54a6f506d26d28978a0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-13_646926f67bc638d81556b99a6a2bc451_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-13_646926f67bc638d81556b99a6a2bc451_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1520
  • C:\Users\Admin\AppData\Local\Temp\2026-07-13_646926f67bc638d81556b99a6a2bc451_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-13_646926f67bc638d81556b99a6a2bc451_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4824

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 33.6MB
        • SHA256 ef4964fb2ab1e78a456da875edc0b9aebfe89eed2bb0d54a6f506d26d28978a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 33.6MB
        • SHA256 d1e61b599adc3eee1efa557ca5c02d9dd253e72a80c1b47698d51efdc987c194
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 67.5MB
        • SHA256 4947ff95b5805c8f6d9a072dd12bcde0d0acf43afa1c77bd986d01ecc52d3cfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 35.7MB
        • SHA256 046cd382a145cfde18d4c2355ad47dbfd40537e089f3a519fb0f88a1de1c8846
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 67.3MB
        • SHA256 a827d1ee94e5b47b2a8dbec29888894b120695110eab722a5630d478d4ade54d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 73.2MB
        • SHA256 01f125355a450fa4b03a275036494729e8eb5795f34bfae4233af600ef284105
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 68.9MB
        • SHA256 4248bbe27dd3ab1d9c7a6b6a49edda5f9303ca475ba64ea72e67c2c172747eed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 70.7MB
        • SHA256 0bfe4340421efff96bc9b7087283546271b1a71e23338c09be670502f37e9b4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 69.5MB
        • SHA256 e9c5b5fa78b942407fe42156727da5c0d86ec3b2b22fef2d9265efcc6392f742
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 70.3MB
        • SHA256 964dfe8329a5feacebe155b3e78123120cdf0e5f4685766c1807feb74f3005cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 68.6MB
        • SHA256 3d944d5fbfaf175a0153fbeafbe2bbebb06dbd0284ba09232c384f6a0d1902f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 704KB
        • SHA256 e5ac195ed95906c4c7d38e22813edc5f1a0626c9af950926575d44363de6f816
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 67.2MB
        • SHA256 19ae550e0cbbb0a1ee8ac920daa934b76671bfdd86838919444c2c0d0e6c9f6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 768KB
        • SHA256 32a4edcc850e91e49004e89b1caaea00d041d8b04cde89ebaa58552b8c82481d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 67.2MB
        • SHA256 953c32adf0f726f3cd0fc381caa8878012ec80acc4cee64c0ea4aeccce48c8c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 67.2MB
        • SHA256 ad9e4301d74dc24a497c25f55b0d4f48b4acf8638e14db720cfe9411f4c053fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 67.2MB
        • SHA256 b9507fefea64bfbaebd43d829771e34dd1bd9a4bcaee6bb4d8924a9e4b7edb91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 67.2MB
        • SHA256 17a35a196d3d07114193cccca4ef4b91f0a404ad1e9f57ffbf91fdafdfe17134
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 67.2MB
        • SHA256 bc5a8b68b2a09dc703ebd14d5b4be8f3ef39d9e3412b4de91647bc2516af2d51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 67.2MB
        • SHA256 d0979f03a56bef487c1eeac34249d716859badda9c886db3691c889b8eb3e0cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 67.2MB
        • SHA256 584af38496649ba268b782faca5f489bae120b24fdd9ff475445d55ff9806dcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 67.2MB
        • SHA256 b2c1332467a90c1cb1fd3bd91b92ae86ea57dc8eae359484bc671ffefca63ad0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 67.2MB
        • SHA256 851f7664e4c3ed7b277042edffb8e10d51c3284332a4d8c06964f1c592ea2ae8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 67.2MB
        • SHA256 e254a29738818aff022ef630f3539299ecd95491228d2d028117660c7fc78c15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 67.2MB
        • SHA256 1fb2cbe33e7b1131f5be6638b87dfab26ed7583088bdc8ce3bc233593a56da5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 67.2MB
        • SHA256 da4b39a4020fa734aa709f6d76c589eece2874c9d60901f1c67c04f5aee117a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 67.2MB
        • SHA256 10b440bfdb8ce1ededbb2a0b638635484b8592847f9c593921ec8f2ebe8a0e24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 67.2MB
        • SHA256 17fcdf3d3156330c01438a0fcc84703c8333a07b8d5f57596d229f0e9d9c98bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 67.2MB
        • SHA256 566cac80870df3614553133f4f0a5177b91823713a927eec149575783a496b94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 67.2MB
        • SHA256 7676b31f118d615ff91ea22f37e64b7b2352d93e89479525a0fdd5dabd8426ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 67.3MB
        • SHA256 fcac1e0ac15bdb3db7fc8330bcb6b4bfb54655faeeb66a0406263a5f9319494a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 67.2MB
        • SHA256 7d8df1d3330072eb644ddea2ba2a632804aa09a4c587c25172ba5acda9844e74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 67.3MB
        • SHA256 9b90bed9817e83b297be2090b4bb9416dd02ab6f75aadccf1d41f84d96c6718d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 67.2MB
        • SHA256 372d6a6cce9e83feb54ec72121b9b677868ec1327f1c43a21b9f09e0ba7f1077
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1520-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1520-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4824-11-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download