Overview

overview

8

Static

static

3

2026-08-01...wk.exe

windows10-2004-x64

8

2026-08-01...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    112s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 00:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_aeae5f08652caa88e64e901a333958fc_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 35.5MB
  • Sample260802-abdn4azeka
  • SHA256 c55d08cccc4927f3229700442b93a933c7c98b558da1eff8e5e6c8f0403bf31d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_aeae5f08652caa88e64e901a333958fc_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_aeae5f08652caa88e64e901a333958fc_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4120
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_aeae5f08652caa88e64e901a333958fc_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_aeae5f08652caa88e64e901a333958fc_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3340

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 37.7MB
        • SHA256 d548ba5fc4207ea38bb9dd6757c4ecca822e078d13c4cbea8a2357447039f57a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 48.6MB
        • SHA256 192b0e154281d8d0ee45614f303f8a8551e07c500a61ee8e8471e8f585d1d143
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 48.2MB
        • SHA256 c14fb584e6b602c2ce8a3224a090f171b779c5fc1a48faf2c3d57558f24faf78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 35.5MB
        • SHA256 c55d08cccc4927f3229700442b93a933c7c98b558da1eff8e5e6c8f0403bf31d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 50.6MB
        • SHA256 6e469ee64ff456c4f760778a491ef763ed83898f9a8146a5e02c0187ddbf67ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 46.9MB
        • SHA256 9c6f64be722c92b647e1de0ee050b5f41c1e86da47225635302464236d74ec63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 45.6MB
        • SHA256 a9294c9117b2ac232121c499d6fd77bcf7ff8fff4d905ed6bd5d8acb879e9bfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 45.1MB
        • SHA256 86d6723c021cb888c24bfea5b1cbe7a55ccab00e78bc0a917d9a649ef0123dbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 44.1MB
        • SHA256 438853184ede73c0259e918108d8b1f4bc9c049e90fb40f9d52e13a03aa2d2f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 42.7MB
        • SHA256 62c18d3c18ce5576a68709f1bed9e70a6364ffe345944af341e698a28e8ad157
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 43.4MB
        • SHA256 54ab31600e903f73759284fc162b5cbd4d6f4a4752079172ecb09f29211f6a9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 43.1MB
        • SHA256 86ed717ffb60b587c42394115e3d3a269af5ae43e42dd31f259e1c1c4b711542
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 42.3MB
        • SHA256 9eef1b573ef748e69b3840ae03cd626caea07eae53924583683c6cfa3f067ae0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 40.7MB
        • SHA256 7c4ada993e828f3fc52d3caef6c97f6c93f300677f13e1a4b10db20388054bce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 40.4MB
        • SHA256 bd96cd67c9810cd568af277e2547f41b29933295f9a71e502673d2353589f061
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 40.8MB
        • SHA256 ab4b909f901ca1c54b9d344bd1f229541c8d406c96bf7beaecf5c44deef051d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 42.6MB
        • SHA256 7f837ddd213c3d792135f1113368aeda8bb47366a5cc4e5099532bc22f73561f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 42.4MB
        • SHA256 a55ffe5dde74805a8f3faec9ab639334c55a9a491d36d38bfbfd6eed16649e14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 43.8MB
        • SHA256 1b976acbef98a34910041c40fb3bc71930f257d291c7dc2717442dbdf450912f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 41.9MB
        • SHA256 e873aa69e5209a6004cff2497154e822b5df1d7f01210dc583a69b3d551a2a10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 41.7MB
        • SHA256 6c64e229feb805a32d705840bc5b107b17e5daaf516ef9eeaff69af0b3cb0604
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 41.8MB
        • SHA256 991fe94f2ea0bec235427cf967be3e856ef3f6c16133ff231f1c20b28f192684
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 41.5MB
        • SHA256 6f614818989e998e1deeda71dfd81ea3a444071772bd9a9edd9e378a6ce16070
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 44.0MB
        • SHA256 d65a449e34ea0d57e6796f1a3eeaf8b0bacaaa889c3da21f7a0305f7852a9fe4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 38.9MB
        • SHA256 4b4085f66f9abf9a2777a567571f72748d07ff55533888fdb68cb4a31243568b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 41.6MB
        • SHA256 f2414ba4c6afe7b69cae5ff131f8fd4278f86de785e65e40ff842aa606d10237
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 40.6MB
        • SHA256 949f15595851bdd88ceb9c9ec22c739c32ed455c93f4fb65ba8d11e7cddb3579
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 41.1MB
        • SHA256 b62d53dde17848d07b0783145040b9e367a03c26c528f5da0ed7803b4b982784
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 42.6MB
        • SHA256 3ae249a5dd3b44efd1056a1411a7d9248c7b341593fc4ba13951b30389a9ddb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 42.0MB
        • SHA256 d1770d333f5614a8fbd5343c818597c01e19b634b7d7400aa0bbece92e9e0af7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 39.9MB
        • SHA256 16440ea8c74ab7de18b7523adfe25fc5a52cf24389042358016f8deb8241128e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 40.2MB
        • SHA256 26f946a1fc5fa66687341cc03071dad5d7e60d69e2d678375637b2ec49931fae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 40.1MB
        • SHA256 baaa6323a72aae3740971598f95c6656cf455279f8a7ee4db8943508afd2715e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 39.4MB
        • SHA256 bfd6a908b011c5020cf011c5f8f54c7940c63073c1d940acd89c10c6fb61f9f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 40.6MB
        • SHA256 d15a172ce77c34df5d88ae9f0f93833b55b14e7e55290e3ae5ed1d8007df15c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 36.2MB
        • SHA256 71d92e53b26b8ee7c5ea43d4330d5cdc6db04ce76430fcbbe6be40d8d047912a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 38.1MB
        • SHA256 90948d5a09044ca2fa31ce6f32263708e6ea682bf2fb9bb785177e92fa519937
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 37.7MB
        • SHA256 a334053dea8859888fe42fd9c6f95f34b01fce2f73c46589804cbe12dfd07706
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 38.3MB
        • SHA256 df0523ff1de14d5721a6869a40fe9eda065031fad15f4b96c751b86dafb239b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 39.8MB
        • SHA256 6d28266a0bde7531c2fdfe082a1138e70ce3639d4337bf303b7e6da38108e47c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 35.6MB
        • SHA256 8ea78c4c62a0e9061c8b036301032bd9304249fb0d02b0765062234589b9dfb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 38.2MB
        • SHA256 54eca728bfda6c5de493ab848cd0d061b7ceec751be7a83be7ec1adec5a1bcb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 36.1MB
        • SHA256 13d2657afdbcaae66f9cde2fccdbab4efb01cacc4424d7c00f2ba479281d172e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 36.6MB
        • SHA256 2d7cb3de3996ee3b690f234f8c827e951a2aa7248335605358eb42aa71ec950a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 37.8MB
        • SHA256 d3f289d8077eb864d2eb973188ab5c827f81f0acbcc6fb8425feeb8a3ce876c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 38.1MB
        • SHA256 e8529e5ed13d7408936ff67a6f3f1872a126d9aca94acfdca3092d0ab48600e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 37.9MB
        • SHA256 3dff2026fe5021df533ff37509e32d19934b1b239b0973aecda3fdb380273fff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 37.5MB
        • SHA256 d32978883ac3316556c1f0f4b12a1a275cde3ae81d9bc747f4e086448fe23d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 35.9MB
        • SHA256 c39d7062413463f6f60de7bd0e0466af498adae24e8563fff6956b021eeed45a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 34.7MB
        • SHA256 b8003be8f8407577e39da2756031893dce52c2a9a36abbe3dd8c1a64a2f64806
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 192KB
        • SHA256 56d5b720b4307ef448fb38ef6495ea0a6fb25e8bfa8f9c140729b820c8e0cc1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 38.8MB
        • SHA256 c84a6aeb81aee568d229985354bc57b830c02f36c4b0e0c368d388caa862ce94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 34.2MB
        • SHA256 6b9eae68b1989d267b4d8c4678328704ba7b99f2e18858299dc094dc5b4ce7e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 36.7MB
        • SHA256 af698fe4980767061682a8ffa03d2cc940630300d2e9244fc6d189eef0118095
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 35.6MB
        • SHA256 33128f91ced8adfd88888cac999ebbc511a8d868ad415c4a880de0aa24e0fc85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download