Overview

overview

8

Static

static

3

2026-07-30...wk.exe

windows10-2004-x64

8

2026-07-30...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 01:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_618d705bb8e1e307deb5b41c60c7ec29_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 15.4MB
  • Sample260730-bvkgeszwhy
  • SHA256 2f7881ae16ea86b2124e56859ef7e6d0ce5bc1330f27b00c8892f67a4a7a6f3e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_618d705bb8e1e307deb5b41c60c7ec29_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_618d705bb8e1e307deb5b41c60c7ec29_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1272
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_618d705bb8e1e307deb5b41c60c7ec29_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_618d705bb8e1e307deb5b41c60c7ec29_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4520

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 19.5MB
        • SHA256 5aac19cb0dbd2a5b59ffe5f87c6607ae307d31220527397521cb5b3886b6b611
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 15.7MB
        • SHA256 625ec2c569111731ebad7ca1fe33dd8072acbcf39eedb4de6d2cbf1d4995ba22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 38.8MB
        • SHA256 c33efb21f0b0e5086f41657097ed904239835f110a1d8a670d7eb899c4f5ea2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.5MB
        • SHA256 6ff4be428c14d37a52836e8643ccd85453694d5b50e5220a35851c003d8574c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 30.8MB
        • SHA256 a6bfe362ead44ec6957c246ddc84f2191243198348db449a423e79b88bad3af6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 36.8MB
        • SHA256 d0f5d0136ae2a14e1c72d58599ca955f11e25dbef55b4b2bde9dc2a5727be146
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 33.0MB
        • SHA256 f43afd083ebc84f5b4bfd6ae00b4b3da72ed274635ecd516142564e94a56d30c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 32.4MB
        • SHA256 98a4737325908591505a1929c625b0420d59ac65c29ee6cf801cc7975c972e38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 32.6MB
        • SHA256 469d502afa26c05662217bd7280141719cd255883a208fd66f8f533f0807ec86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 33.8MB
        • SHA256 209f592795ef0e5fbf32bc57e1beaa2ff71ead7a209f87edf35cebd155578961
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 32.2MB
        • SHA256 58d8a60c110b515cea68a63a7bfd846730c0e960b387a9c6acf4a15f48c5dc85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 15.4MB
        • SHA256 4897eaec119d0b2623cdc38ef89d9e49a1de911e1f4dd1f596053444179afad5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 15.4MB
        • SHA256 91b968e17169ade8733d5cb2fccab5ff7edd6c2bf6a646d52311c23854db28a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 30.8MB
        • SHA256 ac134ba0e849217407464be0ae1692189a2b4f12dc8add97a27f5571c596af12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.8MB
        • SHA256 2d89fe9c9b968badb3eff54affcd41ca863f04d3822e2d003ca2053d7c7fc807
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 30.8MB
        • SHA256 caed899d691dc1ba1f3e262968941b0926fc1c313bd01cba080e7cb6879fb101
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 15.7MB
        • SHA256 6fc4c91dc115a32172be9da2cea44052d1cb2742c5dad5a49f4c26a2aa25d690
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 30.8MB
        • SHA256 b3b92626893c7d89988ededee0294207b35c1d13de913ca668b64a6b1440e17b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.8MB
        • SHA256 7ac32b8a36aac7a0cc9efd32c21fb3f54b04c2045f7b60b4a5767f9044d1ba0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.9MB
        • SHA256 579a9a8888f64469e0a9eab0ec518f56bd9b2e0d3bc2785e9161c2f09fdf2b45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 30.8MB
        • SHA256 9d71f78a6e0e588a89be8d7f099e3eb1f641249495caad9fa1843e69181f7483
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 30.8MB
        • SHA256 7ef0e14ddfd696ad4b0dd3a8ddc11e418ec5ef69523875da096d328b64d1817f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.9MB
        • SHA256 b2f676457e4e20653410826babdeb6c168797c8e1d191e12edd07cc2fb922d33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 31.0MB
        • SHA256 d65532c27106bd73f04501191e91c82e278983c654471f583924c14d0fe4b9cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.2MB
        • SHA256 a8677ca8d49d7899a592f3369906ec1b7d0a8c71148ee7262c6e20c97df1dc78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.8MB
        • SHA256 06e97b7cbafb1bdfecb377f637ae1bdbd393fbd60c059d1836339608ec15d701
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.8MB
        • SHA256 9a3bb2a575c160d325bc124636a60ddfebff5e8ca2a41414bd898ccf2b5ad91a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 30.8MB
        • SHA256 4b0db66a57246b3dbf73ad5cd4576846a90aa2de3bc956aa0277d3538672d942
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.8MB
        • SHA256 d70e9618c1eed095b4cebde2a0cc0bab98e18f0739d680dcfb15396375fcc381
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.8MB
        • SHA256 2325b412a33da3943aa7585a12055d46f410fec0504e69e16adb290486f6bb49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.8MB
        • SHA256 172475751c79dfd7d3af675278f098b02bf4dee477a9670643ded1fcb1132a66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.8MB
        • SHA256 41c8855d64636ab93fa34e045f8bcd6e9f37638d462d3ffe567b5916062d03ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 30.8MB
        • SHA256 965ebf0ab5958cfb2a0e72880135731d1bdbea8c52d87b18d5c88ca411ea91bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 30.8MB
        • SHA256 4d606897b271d5ec419e369695122a33e27bbe63c3994dbaa4a62e47a3f7b108
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 30.8MB
        • SHA256 82da20dced08e7b96d8f8098385d3456b7185d1dd34ab77dde1f510341d1a526
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 30.8MB
        • SHA256 0d8c20678a9644a2ca58080625495ffbdb1e59378cef1dfcfd82e3330573af98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.8MB
        • SHA256 d2ba2948fe5d6a5bbbea579a1a910d2d9035f9b1b002a49b9e55dbe75ea648b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 30.8MB
        • SHA256 040d31ce1bffeea5e3a1731445dfaefaee0682b5432bf33b3dd2833d79b45244
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.8MB
        • SHA256 89d80436f82e377ceb0709ff06445e3bab8a9e85224ff041c8ee16632b712953
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.8MB
        • SHA256 a9f079df4b69bc80c7d9584bc99d732644bee58b05ccde1b34d48077977ae03f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.8MB
        • SHA256 25bb36e5906695579d0734a8eee081c39c7a9125899d30e1a06236e1710bf82c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.8MB
        • SHA256 33ea13c101ff2e30f04568e916464599b69126ce8a60cc6c15cce322a0cd3e0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.8MB
        • SHA256 5d94076236f550060c2811fceb5f20ca5d101e4db419b4cddd9865d299d48cbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.8MB
        • SHA256 591f141142b9c53c07f4458599274a3baed3bfb10fa78ee4a08d8556a1d785f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 30.8MB
        • SHA256 a9783bfdcbccf239e19bbe0fdd5f2093b9bb73b851fb3eeaeaf1dd43e53f5b00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 30.8MB
        • SHA256 0e70daadef2118375d9f889c4116da676c9dc4043aaf836c17de29346be2640b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 30.8MB
        • SHA256 8f88955e79651d4f742dc1ecaa9c3918a4da5df458a5a45bbd1c8d3211fc8147
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 30.8MB
        • SHA256 957c12462d080e44b770e1aacecef4b19f40abd0d88262d741fb3452efde6627
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 30.8MB
        • SHA256 945d7cdd925a78c8e94ab7ba7bef4c2c83bf00087a2b1abbe416a741816a4aff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 30.8MB
        • SHA256 243d9758165e06e9d35aa10105ff3e3e56041a1491b0a2f7a75ac3ec87cf4510
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 31.0MB
        • SHA256 e25b7d00b834e9ab1915089ede341bace7147e3f9567e28bf68654bb835694b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 30.8MB
        • SHA256 f0f49ef0b429c6f1dcd6713ae4a288a1b09a2aa5ae654f528c8272f06bc2fef0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 30.8MB
        • SHA256 db79f494d6b656c3c27a277dc9cd8e170370a4c2c289e7ae7b56a9d3a5579b87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 30.8MB
        • SHA256 8b916b7fc6a43d7140a7b93128ada16f35b748da4ed7daf8645171e547c52fb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 30.9MB
        • SHA256 c7ae717f93c3aabf5c63b37eac7a833d3360c8405c6229f5e385bbb52caeddca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 30.8MB
        • SHA256 c16d941be35a687c7de88569d4f8dabd23c4a451d3a61367a03d74fc8e59db3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 30.8MB
        • SHA256 cd646373f6f74abd0d2a6fb0aa91a5f6c4354bee019f3b5b3c2659a963603072
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 30.8MB
        • SHA256 d12767361f9b66554d5a795dee8fd6cad88d961484d0489ce9dc49b47b68d5dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download