Overview

overview

8

Static

static

3

2026-08-04...wk.exe

windows10-2004-x64

8

2026-08-04...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    135s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 22:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_f2bfbcfbe2db701146212f1999fc9be0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 39.6MB
  • Sample260804-1yxzcseq5t
  • SHA256 3fb71b1774cd6cf219f8803558410610eff6f652c99dd90b7ca900161720e324
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_f2bfbcfbe2db701146212f1999fc9be0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_f2bfbcfbe2db701146212f1999fc9be0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4736
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_f2bfbcfbe2db701146212f1999fc9be0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_f2bfbcfbe2db701146212f1999fc9be0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5180

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 39.7MB
        • SHA256 f8fa0ddf7aae22275c37e245db48ef58ac2b8acc51a2b5cb401e1a06f6cb65b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 43.7MB
        • SHA256 e6d40005a394a860f5f2827194bad0ecf9781f730ba63dd9877a0bb2b9905bda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 51.0MB
        • SHA256 4c3f2cb591d59c6d2593bb0066dcc23d2c87537893c397629d8ce5d741c4f115
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 41.7MB
        • SHA256 92e7c537a62aeb6bf27732c116cf89d041a6574f06d46d2f363472cea878e73a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 46.3MB
        • SHA256 0a0df6abb5749f940a8c614e6d9f0b2c72d560bb691528e065cb695da5529533
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 43.0MB
        • SHA256 3814596dce0f42ced936c6fbb1fb0c7fd250fa5180dd87ef078cb4277f434841
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 41.0MB
        • SHA256 2af47779bb3ae8a7bea18198078c6bcb1a39885c5edb500213d8fa51e6b12053
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 41.5MB
        • SHA256 e688d7d837253d81384fcaf1936635207f590458b0c7e7c0fa2fab6be4830fe0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 43.6MB
        • SHA256 71a3bc2c6c271901a38d29ff3d70dada8b4409b086873549e1c92271038bd3ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 41.3MB
        • SHA256 174b9f59337071d1042595efa22087f112080e16be41619d1e176e3e222e153f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 42.0MB
        • SHA256 ac5acbd096cc22b393d81edda417d40d4ae01d22ad25b9ca9fe252d06472b6c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 43.1MB
        • SHA256 a1850fc726ccbee64ff332b2aa370fb9f94ee55f33a19efa1820390b891cb211
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 42.1MB
        • SHA256 b0a89b739ce34f1931347a913eb170d63d0160532c555d129185344736eaab06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 41.5MB
        • SHA256 f975fa21f3f7a5a353b90f3d531ed98dfc640f603a6e202c8d33840cab703b81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 39.2MB
        • SHA256 806bca4e48c666a229d88745542d650d992cd17dc7ad98083cb0de0ce4fa2a98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 40.3MB
        • SHA256 fdb3c7bedba2abad80453ce199b65a8444266a01b31d21fd3605dfa41fa6c92b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 40.0MB
        • SHA256 cb3e48401b10e9dd374c2e944986f70d2eb8708efd908b0af37a25c67cdc3db1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 39.5MB
        • SHA256 070195a5cc8995a8a6e481aac5f132eee296e9c1489c03e33f922ae0f3fde3b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 39.8MB
        • SHA256 d4217511ad470997d2c6327026c03e7a11075cc75d98d41547f812b6e8c39afb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 37.2MB
        • SHA256 9bd0db74500da8f17306ab5fc4ee8ff84ad9090491afec155827eb8e8ed832cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 36.7MB
        • SHA256 9fefd4fe5a5c9d44d8eb0bae78da1b55929f79ce359cff2e1c29905776a08311
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 38.4MB
        • SHA256 7bdfc9f7173818914814be86219f34c60cb55193eb6d4ecde176f69c7abdd6fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 36.4MB
        • SHA256 0d572ecfaf86415bcdc1c31c554e76353c23fb33753cfb11c96cb9e2faadea86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 36.0MB
        • SHA256 7c33899295c9dd0fa994d676e99317079e6c4b011052723bafe18111c6002426
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 37.3MB
        • SHA256 749fcc5bd863e5a3b9525c6105c6528b4dde87465e187e6b6b155f34bafa0c24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 36.6MB
        • SHA256 d37e11a5093ef785f0fa13993da069ba6cdc86cf47b1bee852c99f86c1ea4ed2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 34.9MB
        • SHA256 f26a07572fbc6c2f8ae32ac95ae61b1c691a3d738a1f72827b1218fa06c0a45d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 35.8MB
        • SHA256 63ad887413ca0114622980977f2a199b548db90e97f9b1aa14b123c64328039a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 33.7MB
        • SHA256 51459437d81ae2b5fbf17fd7bde5a3a5c4c9ef0e530398cc405d3ff32295c075
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 33.8MB
        • SHA256 c5c9a5cf1be12867c9ed42f3ea387cb40cc461afbfd2ef618e40811ad439d62c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 32.4MB
        • SHA256 cae352b6ddf78dae96021b8fc1a909f0a4d1b87eb7b25a80ff2493554b5f2e8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.6MB
        • SHA256 907ba269abb5c4ac54568d895396dec336e75505da748fe3b331326ad355f6dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 32.7MB
        • SHA256 b8f7d021e2f6d54c3e5e18e304828f0a79482b3fee0c255ae2a962967fe13d52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.6MB
        • SHA256 0e96c71449d7d90f65f25d18fc303ede62e26ea0e2b8aa96c218309642d8db0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 27.4MB
        • SHA256 cc68d12c393da54d65e75bcbf60c94315284972901528cf2cf66411b4653f7a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 27.0MB
        • SHA256 578f76e981f75085d7116f89cfde18caca4fbf5a0109ee0fbf04cb9c2d3a25e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 25.2MB
        • SHA256 4ff2932d6d489d95c85e0ccab12d8f923e4bb5b3dc695ef2755ad034adbab28a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 24.8MB
        • SHA256 b97df4e4693d97b57920aa20eb1d0739cb2a3366b50610b6775ef60916ef1ea9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 22.4MB
        • SHA256 b74e046a413647157515cb2573111239ca541f8fb786dd8694dd6dcd51e386a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 20.2MB
        • SHA256 b1ea94a0a3bf92d4bf6307a091ab56ee46735753332adf08657ce345c112b19c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 21.6MB
        • SHA256 a89b32e06589b7d314926cd15af0ae98bcf123d9dbeeba2421376530079f7029
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 20.6MB
        • SHA256 cd48689ad7be9668a18cc4df52d767e2e22cf32b3b0276b201cd855789ce338c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 21.4MB
        • SHA256 6b1512876601993e642864e033cb85804654d29fa99483e29b3ef4f9ce4b1c5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.6MB
        • SHA256 5187e06ad297dc0f6bd8dd5dd0ccd7c4b4309608b638f76b3c426e62c5efcfbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 18.8MB
        • SHA256 444109d618e5a797812713b45bfc6c4aeee15547f924d1f0ed667df37f5553c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 18.6MB
        • SHA256 fe4d101955fbbd8ce4d07d26657af8b11788a5efbc033eac46a5142cf6e86be4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 16.3MB
        • SHA256 c00ef10ac67568039d8c51b59b1e3d20ec439d3b9c4c4065d9937c6af4f38c09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 16.3MB
        • SHA256 c8112d5182d488fa0034dedfdd6aa08ff455c6ec1b5f3e4a9e1972df46311c76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 16.3MB
        • SHA256 88e42057c824c5782a3be9725775ef514cf4af5bb8e3f7d2473da5f76917918a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 15.2MB
        • SHA256 a82f5e22713664876c4ad0616968ed15f78fc3e38cecdc9e71b146361e58d449
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 15.5MB
        • SHA256 a8fe3acdf1d3b38f83ce179484f93c5e2d8e6a18d821b27b137d1b6a79b04d2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 15.5MB
        • SHA256 da9ea8dbdebdb01122c86d1b03d312a8afd11521f2c960417aacd69313e2dd59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 44.2MB
        • SHA256 fb1326ba1c7802890d689fa519be883a88ff2a1461ec37263fbd3da7b87e6251
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 44.9MB
        • SHA256 48095dad97724a8cd1859717e622d669efcdd01dc782ed4d18e0c5c9857444a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 44.0MB
        • SHA256 2198879e4e257809c27b91fff55cfe36c50f14cff7a05e4893165edec4048c8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 44.0MB
        • SHA256 011be4442c10b40b77741edf8c9de9af01011501625612c5ea672c63b5bc48af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download