Overview

overview

8

Static

static

3

2026-08-03...wk.exe

windows10-2004-x64

8

2026-08-03...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 11:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_5eff4a483e0d891943148dc35ad86647_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 15.1MB
  • Sample260804-nv23padp7s
  • SHA256 a6544b268bba78e749510c8f0c7f0cbcbc03625270e5b151951a4e702da0d6a6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_5eff4a483e0d891943148dc35ad86647_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_5eff4a483e0d891943148dc35ad86647_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5724
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_5eff4a483e0d891943148dc35ad86647_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_5eff4a483e0d891943148dc35ad86647_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5844

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.4MB
        • SHA256 f0441e69a2e6ef759bffed73dae5db62d6b28ff170faf4afbacb60297901a4e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 30.2MB
        • SHA256 7951679f3b16ddaaf08761956147ed016aa3bb5f05cb0f08b0e54fccece1dba0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 34.3MB
        • SHA256 ea3620adb604a4162dcdd293d4a101d61869a345062deb536db0036b2217581e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 30.5MB
        • SHA256 45cc7f9230daaa83f3ec4318927570d5abaa5ac3d4d515d9222364a8d16c3908
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 53.6MB
        • SHA256 ac9666df0692943231239777dd7c40ec72487d58e09828ebe43789358636f6bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.2MB
        • SHA256 5963bffbe69690cdae861620d2a1e1ee018daf3abe1b51ef254e7771aed40b40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 36.2MB
        • SHA256 81e1a82fc38ffbea018fbffd713b298dde08c5ce976ad70b63ef91d0d6ba9fbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 18.5MB
        • SHA256 9d7eff316a18150389f3a425d45498c5bd1bba336a5026a606157c8bb2b9916e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 17.3MB
        • SHA256 9a9dcc580cfce134360d5e1ba637755ffc3051eb991b149b48fea1eac338578e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 31.8MB
        • SHA256 f2db28e26f5b18bfa679befef1fa1bfc7eab28c88a30de5a619850ebfcfb437c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 32.0MB
        • SHA256 c9e53274b0d97a616b3d5fe675b824ef2f36a0162a836065b8e12faa18e80eea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 33.2MB
        • SHA256 542ee59636a828bfa27c346570125263bfbd94f4ba0418ff1d948a92fa421992
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 31.6MB
        • SHA256 a8a50dc60c599b08ebf2086066cfc71743999ae64e861c8ba92d96fd00e68899
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 30.2MB
        • SHA256 309ec627cca1c3e59bac8e9b4c0152ebc76eceae26578ee689cff01bc0ec7be7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 30.2MB
        • SHA256 3784169776c78b746c6edef7fbe85c55f6b51ffb88ee1fe7e6bb86b1ab12876e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 30.2MB
        • SHA256 de7f14d9d195049146c005ff1ea198542e30c5cd62516aad0da83aa165784895
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 30.2MB
        • SHA256 4ce0f73c156d04150b67c2450c4baa2d53fc4943233b55f1539d05f6a0de373a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.2MB
        • SHA256 e7f5a5c210fcba5227c45092f1bfb4a1154b5cc66b14a240356d1dc18ac72300
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 30.2MB
        • SHA256 ad89712eba126360534004c2f2cc572564fcf609d450c082d448b588a5058012
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 30.2MB
        • SHA256 8dd6dfd4ba4343aeb12d93957f63d5e552823d6ac196461d9beb74dc76208096
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 30.4MB
        • SHA256 6dc9b56b82085bec3da1ae03b92921813ff50e97b4f7f8c42ca2f9823eac21e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.2MB
        • SHA256 993a861ce89ecf74cb9caa38d852d87b68b606ec5f11c85704d7703a57dbacd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.3MB
        • SHA256 1de9f33eb88850bea57b04dcabfeb1aaed347a43db751af12b9e8b26c8308a23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 30.2MB
        • SHA256 58769f09cfeb08bf9f0bc3aeff4871d1a8ed67f8e00e45c57af4ff713a827621
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 30.2MB
        • SHA256 b4c6f0a6c271bf770d62b48961e111da4564712be365667181483a6e2c9bfb2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.3MB
        • SHA256 def8f070dcc2d108f123e9a363c4d5380904246f5e9c4d924c66ab88edc7a096
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 30.4MB
        • SHA256 64c362bf46a5a17fbb8e46684ae0f7f0681589fc4857df76cd6907158bfa432f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 30.6MB
        • SHA256 b2039f7dfe97a89bb6efea008ab2ffb7225840723cdf4f46940f9d3836bd623b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.2MB
        • SHA256 41686fe5d9c94d8d08471f723fef6cdc65f5e2a02e2a343999c135e2a7b297f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.2MB
        • SHA256 ead682350c93f2fbb3713e98cc702561a1033b85e999f11fe012e039f0651adc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 30.2MB
        • SHA256 c16766eb748f0dd496271f05ce3ebb75c155cbdbda44db029a72e69eead09bd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.2MB
        • SHA256 096bf472241fbb0f1b331084617550ffcb48f1adb78b65f5edffdeee637fe45a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.2MB
        • SHA256 8977d611511c53718d2dbf38f6d3d10f295de017d57f58c17ada71f516f2f360
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.2MB
        • SHA256 b096e42775ec40783b02ca929ec9bc6a86c0403f23704afff917436b390f0af2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.2MB
        • SHA256 91699448a49fd32210ad30c88fa45b8db814e2f6688c28c2720f1a39cabcb64c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 30.2MB
        • SHA256 a57edd753d1d03e5b679a427e0cf56bdd5c04245758db88f83ac7eade0ce2a33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 30.2MB
        • SHA256 5c05fa3af3cef14a1f5a26e253214ee2af340c8f518ce79fe38bf900733042b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 30.2MB
        • SHA256 5c8858b0ddc1314f93c47ae3ca3941b429f65e939f0f3840e5f0cb07a771c963
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 30.2MB
        • SHA256 20a69284ae397e1ff20750a150a08750e9c93d2e8b1235f02492e3630322e887
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.2MB
        • SHA256 e87bd3bb64bf89ad8c74f1e98f8b1bb9992599e0224e3fdd7852c8ef0f78291e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 30.2MB
        • SHA256 a9343b471beb34881710ae00f0d02f7cc01c928f94d8949c181ce73dd48d529f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 30.2MB
        • SHA256 04ee45429e8349d13e5e622f7e30e664efaf067057e37fe4dd3e55b619f81ca2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.2MB
        • SHA256 a66645777018bdf1190af527d4b5e6eabc695cc735f8f4831ef75208736847f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.2MB
        • SHA256 387dc217e6c314ea7790ee1bfe9e30025053a52f204e9f4f44b4ddd2d03f43ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.2MB
        • SHA256 0333dd8146850feb81f8a4f7464328037039dd960ccdfbe3d5d61386e60b565e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.2MB
        • SHA256 078aff32604a432a1facbc96587051f8f75a036125a508d5fb7920e362e75fa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 30.2MB
        • SHA256 c9b6754c3184363c2d856e636ecad278ea05ac5cd678e3cc090fc741c09fe4e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.2MB
        • SHA256 dc3def9610423b6e1dc7725fa0c786458d3f706033d9a87dc5fd03e8edd31fda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.2MB
        • SHA256 f667345edc6004afcf93915ef794b3ab541ab38f4d48d4f9dd15e8dd7c0eb6de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.2MB
        • SHA256 18b5ab3a755030a939b8d07d8b8668a4bac81f808c64c92162d0c4f15b0952d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.2MB
        • SHA256 5ddc1bf754d3a299abfbef6b6ec14556df67d9d84c59e078bbce3525044f3dfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 30.2MB
        • SHA256 7275359e00c1fd74804f917d2e8ea19e5954b589f0429c1144366cd3b7214d8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 30.2MB
        • SHA256 54034d46641d3313ebf8d8093f7eaaa51d0a1918a3bdd83ab1f5bd344465bb4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 30.2MB
        • SHA256 6a550b713d4befaf00de962477cbddae4c0849f2683cb970fdd87c6a20188825
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 30.2MB
        • SHA256 4501ba2f92be709cbd50b2f9efbdbe3108d5932e394e3ce433f67834e2e608a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 30.2MB
        • SHA256 5423c1ae37bcd42a31e7728d40fd43f9a5003198d227c493abd3fe7e7c376e5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 30.2MB
        • SHA256 3d3ed21302fa77e65829e77e12206fd59c92ed46e4e12b9325e0671badf5f7cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 15.1MB
        • SHA256 af37dd3c67decbcf0fc23cd09d809df28be51ba2e8aa92968f693a8b9a13300c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5724-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5724-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5844-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download