Overview

overview

8

Static

static

3

2026-07-27...wk.exe

windows10-2004-x64

8

2026-07-27...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 12:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_eef3aad197157b407f659b53369a18f3_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 10.6MB
  • Sample260727-pxmapasyhx
  • SHA256 67ad29b47d80bd3fdd367b6d32b93f6ef2e7bc8a95bc0be380928ebbe8146550
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_eef3aad197157b407f659b53369a18f3_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_eef3aad197157b407f659b53369a18f3_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3484
  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_eef3aad197157b407f659b53369a18f3_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-27_eef3aad197157b407f659b53369a18f3_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1720

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        BlockRequest.exe
        • Path C:\Program Files\BlockRequest.exe
        • Size 11.2MB
        • SHA256 f7734782993c02c4dd320fc5c8b72685a07522ba610ba7e92da800ae4186b728
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 21.6MB
        • SHA256 c57059c986faa1e01e16571c4d934a73c7364b43306700af169e0bdcda7d12b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 21.3MB
        • SHA256 1f02bdf4bc72ea1a64b5e6003b1564e0d1c21a07cf16b5986ccc7473e3ecb331
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 25.4MB
        • SHA256 1e87242f0dc293372c69dc853203b846f53c042c1f93499a56c606e3b70904a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 21.6MB
        • SHA256 beefaa2d21f1b66fa87016558c1174c5d69ced42cb1eb65576f92c231a11590d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 44.8MB
        • SHA256 302878f6ecd254c35b12587daf4ee3be62fd16664f6f22e0197d0bba636af3b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 12.8MB
        • SHA256 192ea35b2b114b744c566c74a4912ab9af53ed3f1da5b8a07e30c13c521b8788
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 21.4MB
        • SHA256 4bd49a21ab8b97174bc1021444a52ab4665d7931596aa4279de5ca8906642ae4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FindPop.exe
        • Path C:\Program Files\FindPop.exe
        • Size 21.5MB
        • SHA256 d566d352e99e5b82935cf09750d677086a44c82f06341857a3675a4804357a1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 27.3MB
        • SHA256 48a967c48f731013c65fd1db39621c126667d38b89953a48366760e0c047ae17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 23.0MB
        • SHA256 2e6bcc6bbeb46bcab18dbdcf99010d24202bb6645e46ad4ee901ae90ae6214c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 24.8MB
        • SHA256 a8baa9edaf02ba4c4be125b59ec7806aade4c6e9dcc9dfff095763d8905547d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 23.6MB
        • SHA256 3fda14517e4bdd6fa05ede560af92c7ae8ec9029b4f5030fc10484ea33682418
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 22.9MB
        • SHA256 048ea88cc3a3c5aa1d3438abd0e7a2c2ba0279782fb3f0eeb7b393f2a9322816
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 22.7MB
        • SHA256 9579371222db9f947916d9f3b0967ce04e5e9ad0cf297769a544ec918a2265e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 21.3MB
        • SHA256 5d2357e0fde606fc9067ba71be14504f25b6f020fbcaa1c156f91ea319356717
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 21.3MB
        • SHA256 bf1bab5bca7455a3c616c8039710fa6f94b318fc852b2c46d1ed9eeabb7d7e43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 21.3MB
        • SHA256 8a4683958a81682d7a84e055a6d4f944861ebd08b50829a16368b56c0750c7d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 21.3MB
        • SHA256 c8e27555a14c59357295fef509c238f72be710695c8baa00ad76c6ed366ee3b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 21.3MB
        • SHA256 a053cccae482ebb8b15153553b2702471ba6d3d1b36bdb6b9e143201cda70f37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 21.3MB
        • SHA256 555a84cafd754961c756edf76c9887e09e5cd7f3c9ff64ab7b85452a24dde429
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 21.3MB
        • SHA256 33a7607aec20bf14cc50b0dd75d7149b4a7645204d10cc4e0253b6553fa79b8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 21.6MB
        • SHA256 b3ccc8b41c8e0296f06f1a2d34584687c42ef8dae46ae49643fa2b1271dac012
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 21.3MB
        • SHA256 c4f4ebca841e71ae9b37698e64177bdb909a117abf66c7aeeebe24d62381c29f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 21.3MB
        • SHA256 dc5c572222578b48d99f08febe36d68bc9401872623f16761c4fa68e483f9758
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 21.4MB
        • SHA256 e391074ddedc85c032d1d8cceb7eaef7ea5425e9f916157d70aba6ab256787b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 21.3MB
        • SHA256 caa221ea7ab9918ef99c16b23c68682c40448ad85b9e2ff21390247299827bd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 21.3MB
        • SHA256 bbfec6c0d0cebb502317a827491945897f8bbb810e850775d84fc9e7983bb880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 21.4MB
        • SHA256 03721158f123f14a67821aa999e567532c4f7b03b634981111ee190b4c1a2ff4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 21.6MB
        • SHA256 eaa47f193d363cb6b1da4c0fec908dd240278f5ddbd935c55f1ec01f5abe24d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 21.7MB
        • SHA256 9676358a7e2a1d3e5bb0b4f94a005c8fe9389419e9119342b095c7b96a35f19e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 21.3MB
        • SHA256 ad84e5ad50efd89b884239bd70169ab0113876afbf3246cd8089d975c4a9d2f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 21.3MB
        • SHA256 662773dd3a03fdf846beb5716cc291105b9e597652e2895f8b10964cbadd66d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 21.3MB
        • SHA256 e1f756a62de2921471019fed60aea4589fa80350342a7e7b72c8b78d4765af0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 21.3MB
        • SHA256 bda6b8d1d4dd602ee76252182f09f568a647a8f123cb2c15925a92b9c99faa2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 21.3MB
        • SHA256 74dccb6d876fe3e51ea3d2f375aa48e02d1274456004de70457abff0245d2ec3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 21.3MB
        • SHA256 7a06e1dacae55a104deccb6eadc453e16c13f1cce4b3a2af2fe0f228bb6c9918
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 21.3MB
        • SHA256 330ab8a53215143db0d036e5b5d0ba63f9feef42c5f92a98f00387877fc763b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 21.3MB
        • SHA256 d8e8ba2bab8f8602d41dd60b11e3a91a523ae4f939adc98af9ceb68313d961ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 21.3MB
        • SHA256 97a0a34479c3c2da301b3d8e88fe37bbb0e92fdfe6397d412acfb5d427e72ac4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 21.3MB
        • SHA256 7a6b32250693e08f78bb9e837609996e7ab5ded67882c284edd9aba26f450507
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 21.3MB
        • SHA256 00684913010af61e16ec571e6ff460f79fe30254d4bccd9553df4d0c06bc6fb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 21.3MB
        • SHA256 0e8e76a505dfb0495745d7f079e9349017494455c550d65565955d0774457d47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 21.3MB
        • SHA256 f8ee59af82c030f7adf0fbaf510eb49637aab7c595d296fa278396d85cc805ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 21.3MB
        • SHA256 56c07aee8fa64f40bfffef2cb8e585f6d75a293211307be6cd8ac78c6e5ed2b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 21.3MB
        • SHA256 dff88f6e69f1a918a6137c15bf808ecbf4bcbd626f2546cb234cb4e6ca3cbcba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 21.3MB
        • SHA256 765a4ed6094b74f2beab03dd58b6d532943ce9ab62134d3ec753f5d738ba1e0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 21.3MB
        • SHA256 b7860803e8ff893e18396b7056c9c435c1984a33ca497a8c4abeddec807c8e4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 21.3MB
        • SHA256 a0a7c9a4ff30dd62e3dce16df5b4ff96c4279887c5a97e4d3f57999ccf22f406
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 21.3MB
        • SHA256 5548fc5d3931ded8d8375f99d788d2d6d0b824b1b3332c835b266c05b455492b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 21.3MB
        • SHA256 e2dd58cacdbc5e1430df0e66cb62d29e5133ab91be5a9b069a845edf0ffdcba1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 21.3MB
        • SHA256 3b9078bd8671bb5135e0c15e51456cd347dafc4b7eb552a2891b0f733e46ef3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 21.3MB
        • SHA256 083d8c3d01a60f02e3da9826b737052b747634acdc2c728d40ef046cd3d6a48b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 21.3MB
        • SHA256 f280f5f429a6c157e4d1f0a95e30a206e8bfe0f8ef43c653bcb1e7169ffad819
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 21.3MB
        • SHA256 3532b66dc7bc43dbef67f515b2fbe751a21f4281d5e94f805717722a7874c349
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 21.3MB
        • SHA256 625b6b5f5b80d87314e360f409824f148eb7cb7e2fc4a68a11a4a31cb50a5b32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 21.3MB
        • SHA256 e71489ba5cdf03c8aac1c9a5333ba0dd1d7ad7b343b498ef4211172b94db3d39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 21.3MB
        • SHA256 bef0115bd080256d47d7920d94934c310ba5190343235befcd9a8a432be7fd8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 21.4MB
        • SHA256 1f2b73484599d818dc9c185c772406464d09fe9b716e805f4da031f7fc43d7b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 21.3MB
        • SHA256 673e3c35dd7792093686c61567d8b5fa6fe753c10233d8422f69a4a7462f4102
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 21.4MB
        • SHA256 e0ecdd887f3be331fea5020771ab46db6093803be0048205ec7b4f4b0a4a0d78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 21.4MB
        • SHA256 9df5e6e8d0c61d1b2b9293bf438963b6f01e5029083cd71f62fb20038a8a2338
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1720-60-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3484-35-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3484-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download