Overview

overview

8

Static

static

3

2026-08-02...wk.exe

windows10-2004-x64

8

2026-08-02...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 02:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_927054611069b0696fd8084268d9a865_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 12.5MB
  • Sample260802-dck2cacj61
  • SHA256 941e7268dae10c19b808ad48c4dd0ee904cff3f5bc6610a87f87ee48e642475d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_927054611069b0696fd8084268d9a865_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_927054611069b0696fd8084268d9a865_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1444
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_927054611069b0696fd8084268d9a865_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-02_927054611069b0696fd8084268d9a865_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1552

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 12.8MB
        • SHA256 cfa4a156fef0ab276968d3920700259c89106227f4156c555fe31dec2bb952e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 25.0MB
        • SHA256 e66fc4f6ec65402c29eae2a4f8ada9f70ec928120431e0ad1a610c4e0460b04d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 29.1MB
        • SHA256 e4d40524f1ef3554844199976e85afa1836cabc2c30f849b5b422373970b34c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 25.3MB
        • SHA256 9e259170cd08346e11ddc91e36f54e493d5215f428e7b5f4a9a954fb44f95b4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 48.4MB
        • SHA256 097f247372e0a53697ec982e2b3cd65fbf23db2ee0df8c3f49e8c3a507d303b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 14.6MB
        • SHA256 28d887eb16b5ea93e839631fedf61194d459688ee29286ac2b85202399563876
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 25.0MB
        • SHA256 b8de55d7759624fb8f7bf553792198e54c40dad005f8e737d00587925ac274a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 31.0MB
        • SHA256 ac06dd855010c031de22808e72fb43eb31cd13e0d69e5593a0766996fb6a639b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 26.7MB
        • SHA256 381a2973f81521a414096e929cd43c09f45bf98ea2955dd323dc22cacf8fd811
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 15.9MB
        • SHA256 2be21504b22b9d1cd6b0f11e3ee862eea427be0da3b71c6c3334e95a1ed8bfda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 26.6MB
        • SHA256 e3ffdbe77b6565fe5721d4463f0a7e19eeade14759fed441bbd6ddc88397c69e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 28.0MB
        • SHA256 41cf66655925f5860b1f8630fbb2aad8118899e29ac76d266e05e83b94308d23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 26.4MB
        • SHA256 94e4df7b9c2172fe308809f2ea79bc122ab2f1ccc03a0552176118fb44ecd870
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 25.0MB
        • SHA256 8db3159d93c59bdf9786c5d65e9a88f925d7179e95c49a62fe86903928a5cf84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 25.0MB
        • SHA256 46fb56aaaad90ea07791e4a9d29cda3868a2a516abeea1b1ab0b8be980fb776d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 25.0MB
        • SHA256 edd381bfa633882bf03acfff35371a5d652696218e0e9e484e13294387cd0898
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 25.0MB
        • SHA256 3d91877f34db9a2ed297d49025394fb4bdf50a5687c7133030bda1c1da12f8b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 25.0MB
        • SHA256 6e402114c98d4adbfb06b352b84580be4a17cb27434da97aaa9c91cf5ae8cc52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 25.0MB
        • SHA256 7d5a035237695f978fccf68d0cf628fc0dac0dfe12c43c57e4c9c9582cc1157c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 25.0MB
        • SHA256 b00d308520b29cd5f8f5a0e9e5bf81ec7cd8031de3359bc10944241fe31b9bac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 25.0MB
        • SHA256 cee25445523c1fa72bd8fbb6917d54d9e76afe811d4bc4f8c347dff316e81647
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 25.1MB
        • SHA256 eb6764a44343d2587a85111598a976d9f37763aa27cfe62ef5ab5ff984e3cf67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 25.0MB
        • SHA256 166195a87d6ba70eaede41c0dc110b5e42c212254b55308f21383ec4ad60df19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 25.0MB
        • SHA256 ad282328961d62f45e954b1144a38f2b7cf4c192c04cbf4b343ac25e5cd929be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 25.1MB
        • SHA256 9b2c1e3ca1d57db674c31fc6c6e6c5a7f3b3aa4b74720b2bb50857a5cdb67d64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 25.2MB
        • SHA256 b8f01fbd44392310ae723bd17957c69611d9613f98679abec8ba7949d6c9e4c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 25.4MB
        • SHA256 4489e5b12dbb2b3fd8ba1d1288239b564fb168c9e6a61cf07a5446488473034c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 25.0MB
        • SHA256 d5a7e6852c99a9dc27edac553ef2c16c1ff47ea30983a17e6c2ae5e6307801e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 25.0MB
        • SHA256 12dbd7fa4f6a92797179362bc0e648e014adf6d6cc39105109080213bad5ba7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 25.0MB
        • SHA256 24109651af16ca4d85a4f4b8b8554afd110715f848f20a98840873c8a41510fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 25.0MB
        • SHA256 89324d370a935d7057453d506d4910b798bc38ffd67c6e238969a883c042c719
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 25.0MB
        • SHA256 387caf4cb8fa8d2435b2d695eee0f2cc54296f160a5b217d7bc373754109e0b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 25.0MB
        • SHA256 7d71bd50513c5e717e98bc59190b86a41ef07f3e50c2fb296828f3f9ae7950c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 25.0MB
        • SHA256 acc345dee01bddab764819f31346e4b9818e7f6374c5448f6c21ae664cd3cfc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 25.0MB
        • SHA256 b66e3548a9e9c20bcb786b6666e5cd5bcda304d757d61be659013ca75f9f73f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 25.0MB
        • SHA256 2c2d6b8b92d4d852b321aa4939d194678ee3c35257fc05e664d592b95c6d9171
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 25.0MB
        • SHA256 0e5bbb907916c9b83bf3f0b684176ef1c1838126e40920e7cbca507203a886c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 25.0MB
        • SHA256 70ec3e6d572a214101f06c5e531bbb8da3a99a624b810b22a8dc157a6239cd85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 25.0MB
        • SHA256 5870463fa91e64f7e203ebd7ed33e0662ebcf76bb2f8e2ad028efceb7cb11d43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 25.0MB
        • SHA256 beb4c390ed2b87ce2e58d6dc21f4c2c1bd6556f6dde178b15b4be27543c0bdb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 25.0MB
        • SHA256 0e55afd4c1b1f10ec1a0c414107ad4f78289e6d0a35470718cbe99362553d5c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 25.0MB
        • SHA256 0441358d365239dc193a9cf9a4937d2fdf11784beb24f7409edb1aaa72cdce02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 12.5MB
        • SHA256 cc48cbb5747276bd672f231c06734c2e6d2a7c9a98ceb606ddbe21ad32cd777b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 25.0MB
        • SHA256 1ba9b87072d9cac9a69829016b50ab99f24d932f2728041d7a9418bf6cd10833
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 25.0MB
        • SHA256 8dcdc9edd2c5095376bce3d8a698f268089c6fa84732a01fdd8bb7a2066b974b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 25.0MB
        • SHA256 84f5c26834481c9f7613ec8ad7d53938b679cd971145a5391feadbc03be14196
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 25.0MB
        • SHA256 3bdd57d670bf0865f5a3b472fdc872daea9e695dd03858de6fe3be3bd4ad023e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 25.0MB
        • SHA256 bf7f3f4ae2df8bd3c3447d8c2bdbf51af2b7a699fc88ff4014dca6be43d4d139
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 25.0MB
        • SHA256 ea7ece11d7536ca3a5b5f4b4ca072bd81498a3369780565ad7fb30fc2a98231c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 25.0MB
        • SHA256 0e6b2db2bab0e0576a1ce34265983adf1b754959e0d02ed8d44fad510983081c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 25.0MB
        • SHA256 9b74f292b7f5e4c7545645b24169e2475d16d3c7473708339928647f3cdde3b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 25.0MB
        • SHA256 6a84f7c55f1d5f41cee4fdb005827090bbe43ca02ce276a36866657b5b34b063
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 25.0MB
        • SHA256 c52ba989ef1fa26f1b623afa0de0b411d76a8bd2509d0c6579272d408254acc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 25.0MB
        • SHA256 53208400b26ddfa254f31981a76ee7590e8b137bf5ca17e8a20743d84eb4607d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 25.0MB
        • SHA256 3906e45458e6b0c83929386be6ab9e2e6376416f7c3ba7c25f130435a10e95a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 25.1MB
        • SHA256 87c8098805a8247085b07f83a94ea7facafa90e658f563e18db964983ac30f71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 25.0MB
        • SHA256 d765469e823a7b99aafd78bf5b1a40320ba7dabc989520353ea056814ab2376f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 25.0MB
        • SHA256 1a39892c9feb89f45dd069555f836fa898bc07f5096c9ef2a79d067913ba90d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 25.0MB
        • SHA256 6ab7f07d4133c1e7d3e728bfe7e1d7730483640c1ddd75f5cb82d81f85578130
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download