Overview

overview

8

Static

static

3

2026-07-20...wk.exe

windows10-2004-x64

8

2026-07-20...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 09:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_870a35e883156a968e8fe5cccf8cf7f9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 19.0MB
  • Sample260720-ldql8acz7p
  • SHA256 b7bf72c3b6f468822bd4e288629069581bf4a326aff87a21ee41c1f2d4968cb7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_870a35e883156a968e8fe5cccf8cf7f9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_870a35e883156a968e8fe5cccf8cf7f9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5064
  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_870a35e883156a968e8fe5cccf8cf7f9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-20_870a35e883156a968e8fe5cccf8cf7f9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1520

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 23.1MB
        • SHA256 220fcf724a72255d35d40007c7bd197bf992f619d9a83aa19e813f59549abed0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 38.4MB
        • SHA256 65d1da8a357e5c841b40579f26a1a627f45114ca54af006d32b9904c633d657b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 21.1MB
        • SHA256 db33e5631941a628c975b9531f6ce4a7e07de3ef0fc94b1e1579ffb9a1f54879
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 38.1MB
        • SHA256 a2774e903ddfd13b8101efd2e44f157a722a4aa91fd315e96d7489fd3edfee09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 25.1MB
        • SHA256 77eb008cdb3f4d6ceaf45f1917628523166a64fc4b7a74446950d6047a4b9ce7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 20.7MB
        • SHA256 1147547339194f0642adfa6e9f0730819ce7d3561629aa149701bcf4d2e675a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 41.5MB
        • SHA256 0ff654fb0e1e8fae625a17bd149813b670ed5f54a99dc39e32904f9ad1809edd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 40.3MB
        • SHA256 4cc1f2908ad76bc1bf5defd854d1863760cc62b2a02847cd154b0979386abb38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 39.7MB
        • SHA256 5d29c1d5e229b4e1aae2f1a6a96fbc042ee9ac12190c99eaef9ce6722efd617e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 39.5MB
        • SHA256 a9b57186d505c76ec26c2fbf89ed8eb10cf54f0137d44f09fc36589594509d19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 38.1MB
        • SHA256 69fb9d95d0c058b559ca37afe4cf920c7407ade78f90c1a3e483755fb3829535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 38.1MB
        • SHA256 897e0484caabb5d5b7b1afaf8f7e4e059c5e8aae65082ce4864c0c2d73395c82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 38.1MB
        • SHA256 d72dbf6c7705a7935cbbb0466f803ed94a788a530e920077ec59f388261ca134
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 38.1MB
        • SHA256 f006fe2612bf8b090e976d7fa1b3ab3a94e70fffebd47a3b06e360d46a9ea9e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 38.1MB
        • SHA256 06db68a989ae1d29af02e2d45ea65dbf7624b302379b5c16c16e6dc119bf04ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 38.2MB
        • SHA256 4501db2285f1ff8688bc1f95ec4efbf3d6af9e2b1b39adfd15be12dbfb7a5d20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 38.2MB
        • SHA256 35928cead11b9cb18cfb9433f97a095e1e01404b5fd2da003aa22d5c4fa6d2f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 38.3MB
        • SHA256 6e26b55ba7b6ecd040ae06db8ef605d3f8e33c0e2dde19bce863a9123d55ac6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 38.5MB
        • SHA256 1304a884a0d3a317803ca00a2f854736274f2919556654868b68e7827edc42d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 19.0MB
        • SHA256 6c64189b3ffe0aa75a66d64fbeea9a8e473f085129d763fc163b8d42add183f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 38.1MB
        • SHA256 54512475a4c5beaa400aca753234fe3c845cf7af111d01a07bf84bfa04c5c933
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 38.1MB
        • SHA256 a79fb5025b1c0ca29f067d8ba8b7b1c9e3f8d41ecb8f54cf5281b0960fc7b880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 38.1MB
        • SHA256 01b0884254bbe991722e3d8e74592b3b573c663a099d6130123910bb74d8418d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 19.0MB
        • SHA256 2c32cc2964baeaf3d486356adf191499a1283463bb77b5b422d5d9d2cb9990b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 38.1MB
        • SHA256 aaf399f32b4ce75c28a4c88dc36c487e32bacdb68c3b3940b8cb4412b6f2bcaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 38.1MB
        • SHA256 068a7410b392c7a0eb0e76679cc7b9029238d09a37661aeadca8340b0e5910ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 38.1MB
        • SHA256 14149f7501efb8cbf9d8692e9f2f55edd9ed85f2d95b158269d834dd5c6bbd7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 38.1MB
        • SHA256 0afbd293f555aa8301c23ae27ab6a2b096790d31358134c464d70d8b28c45cba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 19.0MB
        • SHA256 4c2f405a4b05e3937d621cece637d0a09c658d0cac1e8d2cafd5e03aef8e99fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 38.1MB
        • SHA256 99bd7d6f04b1a77918cd5026c2534636238dbbe12045fae52b4fc3c9ba646c6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 38.1MB
        • SHA256 a7a68151cf1402fcfa16d070079c4e9f5150c6730fa268d8258e998c881c4fd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 38.1MB
        • SHA256 7f5200f0f4aed6c612fb17df5cd1f4ba3750bf9a4e1fdc3048059cddc2dc7cb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 38.1MB
        • SHA256 6f7e0d4228a77cad2cce0e68349c336719e2d74bac94a4f764d0c0c71009887b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 38.1MB
        • SHA256 b38533248aaa4d3461029227a0679ea899f9e9cb4f452c24033bcad827c995ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 38.1MB
        • SHA256 e2318e0a1a3427f6db7d4072369dd875906a977c0fa14d7d6ff1544a5344000d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 38.1MB
        • SHA256 81e4e592364f7292389795996ea580e339a9a61c7db12d28138e6160c13bd45e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 38.1MB
        • SHA256 6bab2ae93b358a9ae7bfc228f2d9b3c3cea90e4ac10f7f08ea3728dd84d65920
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 38.1MB
        • SHA256 8e8415c9fddf627b18d42ae16f3d8fd144a6765d7eb846c791a3e157df7d6935
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 38.1MB
        • SHA256 cf55abf737ead7256e483d9d4358f687ff610c7cf64dd8ae46890f981adcc0ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 38.1MB
        • SHA256 661e33286506940bee335da87d467ee74d38dee975e045783e1c9146404b4157
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 38.1MB
        • SHA256 49b3a6f1c5c8c46edab5768fd3b143d5f1ef427cbaa7664177550abe6b1297f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 38.1MB
        • SHA256 7c3265831148d330f329ffb6975e05bec2dddb659e7f1653a872c8eb8610386a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 38.1MB
        • SHA256 bc33524e5b52db328083c99b19cf58902dc8b45abc3b512801b0c52ec41efbb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 38.3MB
        • SHA256 c2d5466a7a5e6b730f13a145cb758bef74821038eaa9e7cb1a6da34b499ea147
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 38.1MB
        • SHA256 16f581490dd60c4d08bf06fda84042c0bd4dec18a93fa45357ad7d08c174b427
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 38.1MB
        • SHA256 97eb6abab8b95f2c04473b9ca92e8e61b5f8de3fcb410f698ba8862056baa4d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 38.1MB
        • SHA256 8915829215d5de003f2206375d12b8db3d5be25bff6651b03c129736f037ef09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 38.1MB
        • SHA256 173bddbf2525e89f6c85cf955174d1d573c39151c4b6778a31ac421ce7ad181c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 38.1MB
        • SHA256 7b03068bc90375e9be12ee5439afcefd3596ae431110962655192f0d5a8efc26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 38.3MB
        • SHA256 a91fc06eb765afc53c4c9736bff3facc37bea5a845a69afe698902c288ba92cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 38.1MB
        • SHA256 e40ab2da8317755887f363607b67da7449ed4458983ee7fa3e61d94d6422c234
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 38.3MB
        • SHA256 f792e5bb5d8004c16b564424c722029e5344081c5d117090cc21a5ba696ec39a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 38.2MB
        • SHA256 41a8d941e3dcbf42fe21f5beea67285453d345a879e4d44df7b9f9727ade6242
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 38.1MB
        • SHA256 946a84b51ea13bebb57919651a0ecb7d3105a1c33e96cebaa9c8cb62e9ca1c98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 38.1MB
        • SHA256 d023a18280a07f5706dbf3da93c2a96644bb83550f6002ee9bede86c90156172
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 38.1MB
        • SHA256 0067a1e9fbdc32c8fd085985e2bcd994b67a7a61b1dc9b86ed13eaf05f0bd028
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download