Overview

overview

8

Static

static

3

2026-07-22...wk.exe

windows10-2004-x64

8

2026-07-22...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/07/2026, 17:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-22_af7bab6e1ea240af730ab2745814167a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 18.6MB
  • Sample260722-vsbw2sdn31
  • SHA256 69097cee3be7d6c2c8c4c3947ffc64a121c717db2092da36e9d80fcab6b86ef1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-22_af7bab6e1ea240af730ab2745814167a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-22_af7bab6e1ea240af730ab2745814167a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4484
  • C:\Users\Admin\AppData\Local\Temp\2026-07-22_af7bab6e1ea240af730ab2745814167a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-22_af7bab6e1ea240af730ab2745814167a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4288

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 18.9MB
        • SHA256 aa7578a9d3e50cfbf4c17374cf7b3b9d596445f1749bcdd0edfc40a8c9a52dd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 22.7MB
        • SHA256 e88ff412bef9dd8a746787b303cbb6072e41c9ddacd6a079097669b49055baca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 19.0MB
        • SHA256 82173255bf881d26fcebd3c9ca69124f4d11e6bde71a04e09141315aca6e26a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 20.8MB
        • SHA256 360805a20d5ec0a9ee8d174a9165d8b817bede147eb266c473e419653a3cb357
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 37.3MB
        • SHA256 6d43df1155515d9f5c37556d9fce1251d4ba2357363ecdec1eda94b81f4a6087
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 43.3MB
        • SHA256 06e3cf8213528a27ce1f31ae5a32e499fd924e0e8ed81ee980e20593ba74ff21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 39.0MB
        • SHA256 734f865618a63d550fbeeea1b0f0660952d67fb706551699cdb0ac49535eb609
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 40.7MB
        • SHA256 c94e407f6a8e78ca20e6ae1fd6e08fabef894743751979752e1acbcee70d7fda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 39.5MB
        • SHA256 26adf50c445a1695fd3d8d9fb328b4db7f1aacb803fe87e010acc2d48a7e5510
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 39.1MB
        • SHA256 a55cd313ec7ab29f27203289f61e8f9c07f6ca6dafa3e5c33ec50ce0afa53a97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 40.3MB
        • SHA256 4a71a18a97c19a0c5bd1fb88ab7fda55417d298e634a88b6a1c67d7299d2d767
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 38.7MB
        • SHA256 4acd9c952a10a56e7b1ede65c3b6b1c732f6d9681cf77343986eecd76eb55e84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 37.3MB
        • SHA256 dff8ad2a6e8e5da7abe34d1a5c831be06b048c7b4622ff5abb69b746db293630
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 37.3MB
        • SHA256 c4fa3e59a9a0d66b26d67984b9d7875db4babc74530e1106f35d760802ffed7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 37.3MB
        • SHA256 a363b4f016bcbe45a74e3a3e82c402ca5e76ee165ede41146e40d56b1b465429
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 37.3MB
        • SHA256 7d9880350471aef236701c38fc9955c31a5d0b438588f193466c510f0e27735c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 37.3MB
        • SHA256 01fe4af0b47fc1ac6a13f3a7cb6aeea15f375902d1f8796785c255bb2c5ee059
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 37.3MB
        • SHA256 ca039aa62ffb02764ed3576e81c43db4bc94eb504638d97725f1d0adad63e6e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 37.3MB
        • SHA256 9595a2c30427b2da7c562c14eec8163082b4dde8eb12daa76ddc690470fc6b82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 37.5MB
        • SHA256 907fc44532b5885157de4f82ea1156d282d631c16848640f5e5d38a04078d6ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 37.3MB
        • SHA256 063058c14f677b91f2d43f9b86b1ce75937d5ee53e82fa6e364e2d6f810c05d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 37.3MB
        • SHA256 4e58f97f8cea0cb04e7377c0fdd767d3797917f9699abe97680ad514262668f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 37.4MB
        • SHA256 0c7dc976ed73522d65d25f7c2c63923e8f875a41fdaf0d94536d995d770a1134
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 37.3MB
        • SHA256 347559452f066f34ba199351d5b2847c70ca4cddc1b8ebef00f8544abb2ffa73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 37.4MB
        • SHA256 2fb9bf2447be69ac366bec61d5c4a4bf68d43f2d8f28fd0f1490cfbb5284e939
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 37.5MB
        • SHA256 3244aa55f53d2f5026e4a93b8b033332d3e0a0534a991a8f842077944a75bb07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 37.7MB
        • SHA256 8e4d9dda0ee844b9e1cb6a3ffc75ced1d5e1f23e75b9c1b9456241a204a17835
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 18.6MB
        • SHA256 bf39a56258bf8af3ea9a9ff61a0b6a6ae49cf651c32ed63392982b7bf4a8f96e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 37.3MB
        • SHA256 6b3c0b53f654c5e98f3120808310b91284cce27c5984caa76a45eaa66dd7dea4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 18.6MB
        • SHA256 699ec4b9310207752e5c5b1083179541026cc5f8ebbad26100d3e2f699047036
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 37.3MB
        • SHA256 b640aff8f06e6aa860fab671d07ceb133b37ab82b33d38b5d06b94c87089c9ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 37.3MB
        • SHA256 85972b2916d6491c7807cba523c7a58423e96e4453dcbd8ee8d8086ca0712cf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 37.3MB
        • SHA256 e8c5cd5794e73b5ac8d8b6a5a5b1a54bb1f372f2149d0aba99c7e10d45ca8c90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 37.3MB
        • SHA256 062ac47c62b65e753aa25c1cef4dd830de230a44dc4b3cd02742bfa81b017d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 37.3MB
        • SHA256 09919b5dcb9cdc362673df79888b10622630e329fb0b37a0c8a4ff2eba489c52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 37.3MB
        • SHA256 4201cdbe8bcd2263e1a26d56ee6479d28dd5cb819401a8926ea47f6de3138695
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 37.3MB
        • SHA256 9a070fce5e9ed6a0b716b790673c0dd03b2da2511ff70c6d1edd35741b3b388a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 37.3MB
        • SHA256 4960327fd39112209d56423de321e2c08e00b99214a1547dcf3dc1addb31fb7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 37.3MB
        • SHA256 34f5807e498c7b9655576e5de94467a3ef2d0d6da89e223f693ac7da9366f735
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 37.3MB
        • SHA256 7a29f5b797c8525f3ead3840d9fdc8176d24b0292bee258ccbd061d8543a41a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 37.3MB
        • SHA256 659a052f9609bcbae7383ebc7f85c805792deaa94b57bb80bbcbc560899cd004
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 37.3MB
        • SHA256 568011e4b1c97dfee612ca352c87cd840d932119eb84a0cdf04aa02cc7f36e1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 37.3MB
        • SHA256 d232585026367ed97d27e136b787cba84fa2ba452ba9a5fe1715b40556fe48d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 37.3MB
        • SHA256 8175f2ed87f9e785a5f537ddb7e15dd3e3737c89f3bf3ec53c7a73ce8b53749b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 37.3MB
        • SHA256 7fdf446ca884395a58229660f972f53c24b5722cdb45bcc61ef03538c6355653
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 37.3MB
        • SHA256 db1328f72e3168d1b6c63d9a10d8bf72ed81846dfe66fd798594a773b4700a85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 37.3MB
        • SHA256 bc157ad6784fa54e034bae1c6d8ac0c68bf4746213767615a69a5fc2d72db342
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 37.3MB
        • SHA256 efa71a1e87cc9d373af10fbe57088bdedbb5ae2af81f6eecf178552c791c7060
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 37.3MB
        • SHA256 92f9fabe10ad5e7c1a041ccb39123a883abbe3be78d39da40714b760d3a51609
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 37.3MB
        • SHA256 49256c5fce364ac2d434ddb2359d7d5493b663ebf637474a721b8c6cde5acec0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 37.3MB
        • SHA256 ab5d7dd17b31f8ff1a746f372e92652baee1fa4075dc3a1b52cd691cd7322692
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 37.3MB
        • SHA256 c001a996657d877f6da1f20d270a52f57d1c8fc8f82fa5009a5e06e572b97643
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 37.3MB
        • SHA256 737873412d8ad38b16d4fd0964063e96eea62c90d467070362f005387284683e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 37.3MB
        • SHA256 bb5634d5505c14aa4ed7f8357621e44d6f7cba666c77cda354e3d79faf6092bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 37.5MB
        • SHA256 bf085b12ba9c47666863f7fcc1ce8050032c1d71f7193afed11717e062c42ad5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 37.3MB
        • SHA256 c13bb521c71ce737741672ec28540369a8d102e8a0c03236c9af429ece6a9d6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 18.6MB
        • SHA256 e79906b4ad4a884086fef414e07fc77b79c779192ab7f569b914e5e9c2b9af3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 37.3MB
        • SHA256 f3d87cb7b2cd138907962205422883983c15f83311b5c503dacaf7b30db2ce2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 37.4MB
        • SHA256 89589833209c16baebfa6ad28b5b501b77d89164ca907f42aae421f11b618500
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 37.3MB
        • SHA256 7428adb526b6edd4e5d2a05e0dfdd1f80a99c3566b62e0c38bda733f4d460239
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 37.3MB
        • SHA256 ee7d87a622ea2488a05789fcacf688227a1235618c36d91b6368898bb23dc5c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download