Overview

overview

8

Static

static

3

2026-07-30...wk.exe

windows10-2004-x64

8

2026-07-30...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 23:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_ddbf031e69aee3b481e046917e526e71_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 6.1MB
  • Sample260730-3c2frsstes
  • SHA256 b265aa466aea041650222f9e1fc335857ab657564a14f3fbf6d9314d0e893a89
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_ddbf031e69aee3b481e046917e526e71_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_ddbf031e69aee3b481e046917e526e71_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1344
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_ddbf031e69aee3b481e046917e526e71_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_ddbf031e69aee3b481e046917e526e71_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5516

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.1MB
        • SHA256 6dd5a3af8646985dd10401fced6fd5561b01481184057c51d674db4ba23feee0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.1MB
        • SHA256 f46ee7af72095e37a309c08852c927ff7caa67fd13b18a1609d104f42022c328
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 16.3MB
        • SHA256 6e9fb26a00ba6d6be1bbab28da473fa85484ce383cdfe0c6a3fbc843a51d2978
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 12.6MB
        • SHA256 fb85c823aaf836f9a94fa45c0cd5a6bdda2455f1a357bd9329f47a6d479b63ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 12.3MB
        • SHA256 8fd81e251b2e909d91907a9ca96e81edcdcd969632cb53a9f46c6765f5fba4a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 14.0MB
        • SHA256 5dc88a662861f151d481cd14db31dead37a1436fe9bc6dd74b101a4cc5d4cdb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 15.7MB
        • SHA256 a0b2436290d059e06531bcd347c7ab7e0ba73ac19eb885d5f6261dc639ae4b10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 14.5MB
        • SHA256 0b49ddef7b693aca24cff5c01a67f17b12ace595e83206898c7743704f2a9ed9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 13.9MB
        • SHA256 8d8845fe666064a70962ff94939c812f3b1fc89c5a9fdd982061d9b2ac00e67c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 14.1MB
        • SHA256 c5b98af617d7781f32c426e514eb038ff5f887a1cfbceb5d90cd6dc3d7db264f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 15.3MB
        • SHA256 d6f8ce2772f2fe56012c1d11adde73cdc4886193ecd61d7e8d102e4fd0483cf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 13.7MB
        • SHA256 37a93228a451c77b62258a107ab26504475a794e9786f15e63930f9a89a19c1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 12.3MB
        • SHA256 965607ba3ebc1008599c29b3fb3d3619beb6e649b74b8835255a7f29552917d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 12.3MB
        • SHA256 51ab23b435844f469571f33f6bfbba559a2e5b942ea0b83492ac435ba97c2698
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 12.3MB
        • SHA256 9ffa72265a929662666afc88993a52cdaf9457410bb42a5a2a3fc5b68b2aa6fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 12.3MB
        • SHA256 576eddab5261b789b48556aa027d2118385001f36839f17c9e917d3510ff4193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 12.3MB
        • SHA256 e272f48048e1662a6767204d75acd6ff3a3b0ea3b2ed41329e5fa5ee1832af76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 12.3MB
        • SHA256 cfe4beb8638cb1e00b98fcb3afa1db75a032d9259b0d8678e176a4a73405c6bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 12.3MB
        • SHA256 281490fbcc2f120cdaa08f1aa5c15041c360ae0a05065aa6c51c5280cd82a9c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 12.5MB
        • SHA256 a54d753cc4b6202a475d5800d1165e8bad276c73b790c7cf6948882e4bdcf0ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 12.3MB
        • SHA256 9871e5b5fb51b150e3ed9c55a8adb4d8381329291a6aa603f4adb3306e21f893
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 12.3MB
        • SHA256 a93a91f28e7d98cf4c18f43eb69802c8946c42f9601ae1fdaa78114095fab415
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 12.4MB
        • SHA256 b56aaf400356ea8e7a71d86e800cc3bf98af19262c2efa8cdd221ad98082140e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 12.3MB
        • SHA256 47520e75853c7f82fc39a3712492d23d4015500076fa08c6a669959454e7c36c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 12.3MB
        • SHA256 18a5b23ce7ca89adcd5be0acedb3bf4abf31c9f3d6c8d03168a428a21b1207f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 12.4MB
        • SHA256 5f7b987387c5fa17d0c588fd04f35d2336f9246c92f2214d56760a0a62abfef0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 12.5MB
        • SHA256 31f0867d573fdb53a2924b9d0fb4c5b0ff39c247b21559d52c0e21b96a9fa111
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 12.7MB
        • SHA256 40aa07e0c0bc0c883be0179289d5f823becc93b435f15c0d28ea196974f94afc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 12.3MB
        • SHA256 865e5f66d74550a7799295e0b0d89df02bdef7604dde58763b85c83ab4db67b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 12.3MB
        • SHA256 f004af8cd2870237dceb7d5c99d9f8ab4fd1b85aed6c30cbc4d058c4bf09871c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 12.3MB
        • SHA256 29fda79d4389633ccc4d5a69f48904aa34a5483987c3003ac5f5ce904b3b79c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 12.3MB
        • SHA256 8f15c8dd62c4699b3dd5595ff04ca1f90bcdcbcd63f94025761295afa5e7d3c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 12.3MB
        • SHA256 fe301eeee4b7da1242782aba540c409f0e386ebc9b6c25b91f851710e3ddcf12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 12.3MB
        • SHA256 c0b69a968b9e3cda3f978bb9b71c1c822fd31d7ff9b46b96af1320cd02f519d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 12.3MB
        • SHA256 dd32b5d7e1772b24028ba475ccb24a748f9b9cfce5f4967854721e133300acf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 12.3MB
        • SHA256 66bdda6966dba1fb5fba6adae1f3360a5faf54f3dd32c01be4efcfeffaa193bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 12.3MB
        • SHA256 790c53e8c1d2116da03bced0747671a4806bc7da42b2ca474f72e2cb7ac6f5be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 12.3MB
        • SHA256 76f7556dceca294a1448f3c5e8d92613fb84536e9c54044769790805d8bd2d17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 12.3MB
        • SHA256 775add00677303e2cbf68e564a21f5f6ab16501b6b767d10045d1d680a6d9bae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 12.3MB
        • SHA256 6d1a3cc91806149c387df0167f8467fa8064ab3bda7eb91244c1a8c8c171c758
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 12.3MB
        • SHA256 8bb521914f7bc349058fda118c61abb349c4481d9faf33355a51627929256868
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 12.3MB
        • SHA256 5c87cb80ddbbfd021ee89a87d9651e24a6c09521c030368edf04199429d20621
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 12.3MB
        • SHA256 48475a16db68a14ac6e1376f81a8094c48302ddc29c4ec323c9090e3c38dec1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 12.3MB
        • SHA256 14f32b98a73109f47d834c6a3579c57511ab8b315d42ec03a942dd22bd4bb53a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 12.3MB
        • SHA256 dbcf9ffe7fcf5821621bfa3a8243b19c24d750f48fd3ccc10cdfe2c8bd86049d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 12.3MB
        • SHA256 d6a2f21ea694492e8116e7b4da6a65a1b9f2518633df700698df9d4e0dcf01aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 12.3MB
        • SHA256 e3fe43153d09c3db7f63084e6351a5b3b7cb5cca39503db251dd810c97427af4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 12.3MB
        • SHA256 8b57458e3a798a67a9f0e1ad9502536462a6781ba00ce132c0db8b34b0fc546e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 12.3MB
        • SHA256 de4b849939b6ff71407602747cc710d94f8c5cdf14f70344cb31296c5517c9d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 12.3MB
        • SHA256 aa46bc330d82f447263591e258ccd6c544fd3216e4a81f621ebdce72e3a43608
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 12.3MB
        • SHA256 b8c0b90fb693f23520055de916a82987602f3a6307941fd63afe047f8e332414
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 12.3MB
        • SHA256 39ff68bc34cd5237a0f1c111eeb36f75024dc163aa8f54477dba5a0ea8926dff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 12.3MB
        • SHA256 c02cf66ec18b6ed1618afa648d109b7cdaa95bb798973033a9080c52f1a09c3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 12.3MB
        • SHA256 7162d88c59e10f841724360d3579a861af84ec6338445704ad522ec6fcdc8311
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 12.3MB
        • SHA256 497ef20c0da158e2f49c1a815cdba3b70d69ce129db9ed054b689d12a0b1306e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 6.1MB
        • SHA256 34bce3878efc110247b8d873b84b2f6f67b4327311627ae7277360a4f9b9ac38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 12.3MB
        • SHA256 d7a67aadb869a899a1f6bd5ab6cd145ca7af9d4fbb32aa83ca3b1efbfbfd0067
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 12.4MB
        • SHA256 a4d23cd74a4a89eb13843f980b2cd63bf8a095c0d97607fb66c4b0826fab432f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 12.3MB
        • SHA256 ae12107b5d60bbbc08a0517b93f4509ae0d8fdc499e1da2a9a3eb8c9731fab43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 12.3MB
        • SHA256 3b57a50442cf7b69166ba6b798429e3c37b0244924f05e1d4ac06bcca4e7db1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 12.3MB
        • SHA256 2ea7714805fa64f45ba8323a94380b55f15c15c41e6a2d059015043df622cd35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1344-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1344-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5516-32-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download