Overview

overview

8

Static

static

3

2026-08-04...wk.exe

windows10-2004-x64

8

2026-08-04...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    50s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 22:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_86f5261a7220d46491bb3784f321c791_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 29.5MB
  • Sample260804-2mg97szvbw
  • SHA256 9cf960c1ba904b067571cf50b5882cf9d1560bf0ed20db68ebb4acdc9814e53f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_86f5261a7220d46491bb3784f321c791_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_86f5261a7220d46491bb3784f321c791_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3620
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_86f5261a7220d46491bb3784f321c791_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_86f5261a7220d46491bb3784f321c791_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4740

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 31.6MB
        • SHA256 9d083768e8c5feaa180884df4412ccbe3720143b49905c34f242154b8bed015f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 29.6MB
        • SHA256 bce88de5bf06cf7bc0668d1bf73d55b0954d22c47a3b33fcf3246175634eafa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 65.1MB
        • SHA256 66f80839db99fd3939b1e04b811769407517f01e9fc715b3d0a1a11220e30212
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 60.7MB
        • SHA256 752b2b40f594fb610c2aaf7cd105ce286e0d0a2d8f21ea063f237053c6226e39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 62.5MB
        • SHA256 a49ddfda4b689b8fa3d8460462d02b4242e6ba20d32bc418e3594e604d124243
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 61.3MB
        • SHA256 6b5b7b3e5cb7c43ac349e441d853b0c05ccffac92bd3bff3ce78b0f081682d85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 60.7MB
        • SHA256 38448266c30ff9f2035654e43f6752a1009e4a70252df5fb2e272572a106f04f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 60.9MB
        • SHA256 0f202d34faf042f72f1517dacf5ad1f4a2c8a8acfb5faf0cc3b2b827e273b759
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 1.1MB
        • SHA256 f7324c78eadec5eb9e6691e7753405a94816b7f2d45c7ed4b38c6d136a40ca96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 60.4MB
        • SHA256 039cdedaae65ab5357a79860a3c143d810a4818b918b50344ae3e489ed485940
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 59.0MB
        • SHA256 7c74ceb6727a5648468a63375d85fa21954318ef01b6a9ef9d53d5fab25cbf4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 59.1MB
        • SHA256 92c07ecb6681320f580d5a80f5d70884151b67468a36d3f4dcc4bab51c3b1973
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 59.0MB
        • SHA256 384c7f4e0b662c0d652cda9adc1419568301dae937c37060a4a09d7c96e10e1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 59.0MB
        • SHA256 a0f6b72675ef3a2ec198956cc131cb42fc5790d5f53d2ddb9a8faf7ba3fa0514
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 59.0MB
        • SHA256 cf90fc8b331a1ac769a066522545c014b0d4049f7aba5f5d240f516da087114a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 59.0MB
        • SHA256 a515228bc8a53d1d50c043231b4ddce9e25eec2f009941264caf7fc0e340b346
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 59.0MB
        • SHA256 cff785e41a0373c89c5b75205be50bf42d336738efa729173e94383a851fe6e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 59.0MB
        • SHA256 f604e3d5501b85aff345c1deabcde87b28212af9b8e0d90c2427b5dab82f6631
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 59.0MB
        • SHA256 098c5c96789b2519cb82c7290a15f04adba3cca836ed69d3bc407ea464c9d2df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 58.9MB
        • SHA256 4ced19b0e873ab58b0d361c3f792deb2ac2fce17e5b6fc0b709c795de8b12296
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 57.9MB
        • SHA256 89ee1531d00eaa6de03a2bdb7a4f4e92292ae3d36f24b8e51864c10404aa86fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 56.8MB
        • SHA256 b72e38b3634281fdfebebf65e4d3addad0b20bb7e2115a2fdd7ff8ff98e636a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 55.9MB
        • SHA256 388ae6e8249a9748f950e2d3ab603042d329ac2a2b13fe951702f88c3a867d18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 57.2MB
        • SHA256 32b75abcb047756a71657fa9b7f2087de549cf8b4e2aa00ee4641ec900ef72cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 57.3MB
        • SHA256 a385d9ba161be5555621b0646894c9a250dfa5d0059b7f511777598df84e89ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 55.3MB
        • SHA256 b604c0519f74ba477665c7ff53e71cfa8b55e2cf7c40e34ab2213626209b5dca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 57.6MB
        • SHA256 63c5b25c47eb31bb0a89b5192ebd174e048a04ab011e12c17c6764ffded0684e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 256KB
        • SHA256 6adff2403606f3fae51ba272308ce91c8124c63f116c3d886a5a38b4ccbce497
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 54.8MB
        • SHA256 8f30357d3e89f514b9887f82a659f2fb064c610c1b80d955dd66a887461ea6c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 52.0MB
        • SHA256 6947322ffa6b96385a3825c5e2a00c3ade9957e8c0c3e73c9345b6f3e95de90d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 53.8MB
        • SHA256 7254c3117e2d17e441690ac9ea3ad66b83c62a16f610783a763d2c2a3cbaf3f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 53.9MB
        • SHA256 6298e3f93272dc6e018d5edb62910b6522f13902bc232f8fa81ff201b0521799
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 52.6MB
        • SHA256 0a589ab98c02827e066af3a355d1f6ff5fb7406f805006db1741daf7d0678a7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 51.0MB
        • SHA256 8e902950398bdfe7bc780db89f48e9af1a7802fe7b5db88056451e3d6bc71120
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 51.1MB
        • SHA256 f81ea3fa304c3ba584c1a366829f7eb0f4e82a2ec8375a7f527a80ba89e26e86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 51.8MB
        • SHA256 e8645780d24f03a94933d5f230bc3026fc9d3797948f9f2b67d5b8cb7eaa4846
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 52.1MB
        • SHA256 3437c15b6301bb30664e995050aa47843531c3afac67b30a826318a345df20a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 49.6MB
        • SHA256 45128d1c7b0500593270d939e71ce99dd7dae8d1a956c9125c581e4db4aec59e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 51.4MB
        • SHA256 93a99c53eb8eaecca2250e988f7311587662008df986728ac72c302b4bdb5f8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 50.4MB
        • SHA256 97834faebeede84663499e53867a5837d4e430fd45b46db8fe3db127020ccc7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 49.5MB
        • SHA256 a10c4f614fe7fff67d55a08439fb64d7f1a085aa575834a4b305cb5fe5d7def1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 49.9MB
        • SHA256 1e031c9b53fa94d90ace28913f4a5eb32e45091fdb396252289f43e0f59fe9a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 49.4MB
        • SHA256 8ca45cb4632a833e2eb1ba1c033e36224f779feb64e1b142fd16effd169b4bc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 50.9MB
        • SHA256 5af92c12099344862bdefa58c864ade2eeb9d7cabfd20baa7d103ab1ad75b160
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 47.5MB
        • SHA256 aaf76948ae8df3ec58f3e0d289d4f1ccc1391eac66dce0aead6473a7a67fbc5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 29.5MB
        • SHA256 9cf960c1ba904b067571cf50b5882cf9d1560bf0ed20db68ebb4acdc9814e53f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 59.1MB
        • SHA256 b78eab2f0c26289555ce1bff7b969f06e5a77a15b030cfdc6cadbe7e8b5080b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 59.1MB
        • SHA256 2df702dadd888eef050f0ca02e8052e88eeee1057af6a84834498ea83a796f9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 59.1MB
        • SHA256 c2bc7e6077c6b349c33ddc816aaa6de28482a2e3203de6378ecec053308792e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download