Overview

overview

8

Static

static

3

2026-07-29...wk.exe

windows10-2004-x64

8

2026-07-29...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/07/2026, 06:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-29_be3e4ab57fa3338d61cd5710e447490c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 29.7MB
  • Sample260729-hc8vmaxbqc
  • SHA256 26987067530f976863db9d6c46d190a85a498ca7dbefc77a72e2468a22f24147
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-29_be3e4ab57fa3338d61cd5710e447490c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-29_be3e4ab57fa3338d61cd5710e447490c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4556
  • C:\Users\Admin\AppData\Local\Temp\2026-07-29_be3e4ab57fa3338d61cd5710e447490c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-29_be3e4ab57fa3338d61cd5710e447490c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2400

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 30.0MB
        • SHA256 6d027cd3bdf0d9499831d82f4c7650ccaabc34ab4a122c69c16250a59ac6ea5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 59.5MB
        • SHA256 0b691bf418bab2e35219806cd4a6190d7ec442264ccaac5f06a6b9d3355040ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 63.6MB
        • SHA256 5fa6773d4e974428227d3b2fafdd5547a86f595e68c3a000b66c00e1d08a1143
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 59.8MB
        • SHA256 00a31740e705ba0dfaefbc92c404d055f0b9150d518f0ff788240d6c1784f278
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 31.9MB
        • SHA256 bb4bbc9aeb70a83d449709bc2b029569fe336bc05815af40b8d76a21bb7388a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 59.6MB
        • SHA256 66665cd744f9d38e95b03483c0bd0e504f4c2428387b164f68a2aed19640119a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 61.2MB
        • SHA256 720787acd30864e1cddca82fd0bdbad5bdf2d1ccd31a9fa4176ce734efb3755f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 62.9MB
        • SHA256 078819d1deb225ef7f750da98de0d1355a0e0cbdfb5fe97bb2d4e3d018974262
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 61.1MB
        • SHA256 cd96b1a57e57c4f5a81910ee6b0bbdf860147cf317ad0cbfd177388d092fda52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 61.3MB
        • SHA256 c34451d53bc03baac677e5de72b565afc087a6976d63f1cb63b9c9e2d107d7c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 62.5MB
        • SHA256 9e055748b3bb744fbe4ed4e6a81a6b2d6991cc9958cee025b85e029e384b6517
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 60.9MB
        • SHA256 bc536f0927448535bdb0098f3f2edd1e5796cdfefbe4eaff8abc30b67f6898d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 59.5MB
        • SHA256 d4c9977ec2c2e3808c8e30657ea41f2fae6ec656339161299d4129bbe84f9ada
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 59.5MB
        • SHA256 9d75db27c6864ff674b3a9d2f86b9be51e817721dc1022e95db906c7c7c790aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 59.5MB
        • SHA256 e631d9c1d8a90f1c944291edf9f5b69661742261e93f246aea9ae1ee650748ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 59.8MB
        • SHA256 8af5e78d172406d5119050e50fdcde5f5822033ad08d3f418bda2d725b3e1db2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 59.5MB
        • SHA256 3d9fbf53f9f5d5aea7e73d462f41fc94816dd844b8506891ff463683ec30788d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 512KB
        • SHA256 fded04c6d782f8085d397cfe282605c1f1fba531c6920ee79072db343ae14316
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 59.5MB
        • SHA256 372c339a0cedfd353755ec3e82e4a04d2e691cb20c80e50dfacb5481d6a34583
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 59.5MB
        • SHA256 9dffda479bb52c1ed4346ea8a635c90ae496c2b785e92ffa6b3b2e62c4651769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 59.6MB
        • SHA256 75a276b15f71ace9eb0ec8f5076ca55f8dec92498d6de0317f5c20df6ccbd572
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 59.8MB
        • SHA256 6f10ffd3baeab269ecaa279e849da580c90f8bc2f00a1ebb528ee1bda15e4039
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 59.9MB
        • SHA256 a25fcbdda52998f8b547af86bcdcbc53cdd0094d2c4e4b0d5dd9930e3eab7531
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 59.5MB
        • SHA256 8272feb585f9f00e15a0e841dbb3e17d42acbf70c64f58bf25896265ed3b72a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 59.5MB
        • SHA256 9f5457951afa39b3e913813c11e202e20734a0c3bfdf9a9d5cfc803c61a2d656
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 59.5MB
        • SHA256 416def6cf66d8b711f343b8e63e5ccfd76362feef035c19de8f1a64cb30db8f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 59.5MB
        • SHA256 06390f0838a11cff5056e01ef5db812ec36c326d739ed9bcf02fb819704bfbd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 59.5MB
        • SHA256 8c16b413838c9203cbb4e577d52b54327ef309354b7d1d72ba3d1191e20c4411
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 59.5MB
        • SHA256 5ddc642be321899e99e68f3f44a16927154fedc27f020315df0de825a3a06f6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 59.5MB
        • SHA256 d21e10c01e03520ec262828fa18731879e8988f18209d660a6376b4134a025ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 59.5MB
        • SHA256 b6e2efd2ca8a51f558dff13156cd3d6512d9d93aa72062dbfa999a9a296685f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 59.5MB
        • SHA256 d0cb2c10cb11c4f10a2d8d1c74e8881613945f8640e4d011a4bf10b7fd78e36e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 59.6MB
        • SHA256 29b900f56d1f18de0b972511e22b4cac89be287afabf2a2f1857830209a81b58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 59.5MB
        • SHA256 ce0684b696fc153c6aa45cad5437a9f09afa189922c078b5ebd6068ec337cee5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 59.5MB
        • SHA256 7a7c28d9773119982cf1d9ba860e204b4672b6b752fa9097f882a4fd3756673f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 59.5MB
        • SHA256 164307d47b57bfca9c630f252dc28f5c49de7694fb9a096ca0a26b8370d2470c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download