Overview

overview

8

Static

static

3

2026-08-03...wk.exe

windows10-2004-x64

8

2026-08-03...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 12:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_40470eda74a54ebc9b225c198b435133_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 30.3MB
  • Sample260804-pgjjvsem2w
  • SHA256 2b7788e6c19e40c9441578268f5a9ba9073befaf08d7e820f9df6dd988145599
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_40470eda74a54ebc9b225c198b435133_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_40470eda74a54ebc9b225c198b435133_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3728
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_40470eda74a54ebc9b225c198b435133_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_40470eda74a54ebc9b225c198b435133_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:416

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 30.6MB
        • SHA256 f6ead4cff8c14e23774c7329df97398367c7ddfcca567ef52be2956e3d9d3b10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 30.4MB
        • SHA256 93bec1215eb1ae69c092d87f68588125dc399bcc9e98d054c512c01dd5986038
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 30.3MB
        • SHA256 2b7788e6c19e40c9441578268f5a9ba9073befaf08d7e820f9df6dd988145599
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 44.8MB
        • SHA256 2d9ad1172edbefc213b96079c75864fcad0758b7ab413a231bd6ff70535d5c02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 32.4MB
        • SHA256 d1f154402ad2fe329cec825d20d09f05792d3c1715bd346a72b978e486b79f54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 38.5MB
        • SHA256 c39294c4d2cac1ca17706bf38ce73f818fa3f50d9302e234f4514700a2a824eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 38.2MB
        • SHA256 86f96f3eb9f9f377dc00b282b55fd98ceae00a84681a0c100981223906b55d48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 41.0MB
        • SHA256 3c3ff71e1b9c50707c4bb32de3655f715170e7dd34ac3b5399b1b18daf755aad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 39.1MB
        • SHA256 453f69994fcfcaced5dd900579ba6008c2548a74143746244c4be86c61f09eab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 38.4MB
        • SHA256 9c4facefce5bd1423794498bf6af265813bcce9cb02b2a7cbeb679e469e3fef0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 37.7MB
        • SHA256 4e5af821d1c71b9f08f3967f51eb6a41ae93e3fde8515a08cfa91d02edd0aecd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 37.9MB
        • SHA256 bf97ae445c266189d1e431e3dd4fcae0e1676ec23c0ea4ae690d94c1be49ac07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 35.6MB
        • SHA256 5287e9afd2c392764d190f2d19728ca585b40c61b5fe63b32088455e019489d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 33.4MB
        • SHA256 da29679f5bff7773f96007409f045a5e8e64c24f6f3649783267b811070ddd6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 32.6MB
        • SHA256 6bd6ad70d14c05fc944ad4ce773a1cb63b701a517b2a71743bc3c0ce6cc4cf74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 32.9MB
        • SHA256 1e4a26e859fb06387d2b6a2810d12381b435c3e64396c1798bd38f6d94a0d528
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 30.3MB
        • SHA256 7a8f7d833531eda5791303d26d8a06df0a0d2d35ee608f986f6a83ba55180f16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 29.9MB
        • SHA256 8faa87e504a2edbff1a0ce871d676d1963231005db63944de1a1463b3f013c47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 31.2MB
        • SHA256 7aecb8be24ce0031ee8adb86724925de43fdbb4e40e336a01f476bf74959c3cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 30.7MB
        • SHA256 80c7db5756193c78a71aa36af507b51931a65e33163ec47f528108d5efeaae8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 30.6MB
        • SHA256 8eaf1f4afdb10dc0cdfeb5d3932cba72555cbf2e36c3df2e34081d379203f488
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 28.1MB
        • SHA256 eb2179508d7528345cf62d65544a70eee38356cf7a0e8139e0d39598fb7b8c07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 28.6MB
        • SHA256 7483e1ef2e175bbcdbc4d8344eabb61e4922ba12781602ccbe45c1c7fc21538d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 28.9MB
        • SHA256 86b8e78dd9649575142427ab7578464978be90d66f8c288329c49f85de5596aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 29.8MB
        • SHA256 14c912c88eb57e44fef3b99d4491d2b5b3c9ca5188b76ac548f8ab2b736d7dde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 28.2MB
        • SHA256 7e483367397c2bab8233b1d0cda4557c23406e739ed9c017a1eac9de9c9ea164
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 28.0MB
        • SHA256 dc0760980dc3a45324951aff5399e7e68ff4373894fd7d568b0fcbec115221d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 26.1MB
        • SHA256 5902751666bedcfbfb15cc6ea2faee16c8f778394ce2efa3ec8eec6cbd0d0795
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 27.8MB
        • SHA256 0880a2e1c65c3b2c94dfed65f290fdb0c28cb20e1587a880e68bab393ebb209f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 26.7MB
        • SHA256 38aa35e3cdd66a625bd16c29f8b7d38149bd91a89d10ac31ac468f5d71457c9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 23.8MB
        • SHA256 e7901f5cc2155ef4263d36b44dda875ecd46bca10b2b1f638ca2210e68beccfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 23.1MB
        • SHA256 b9dafb767f0485501df0bc6221432b163726b7289a88d8f4e4d3d691733dc6df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.1MB
        • SHA256 d99c8de44b54d4aaaf29b431b3734d496c759895df991763e99c1c8dd648cbb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.9MB
        • SHA256 4a5612b77a78cd1e9223b76f2ce47afcd72b7cbdd095cb91e955ac2e2c39b448
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 21.2MB
        • SHA256 28009706ca2d5e22969b8147916c2fdca10031ead79001b032811178c9c39e37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 20.1MB
        • SHA256 58a8c2b1c0b29373489df3d71723ae8c97e04c4dd629883513d3523ff81af380
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 19.8MB
        • SHA256 e10d41254b9cf59c5f7123f47889fe2eb570642475a31afef45c3b7e0b8f772d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 19.7MB
        • SHA256 648d63862634b17941b9c5cd23eb095eeec2bd97bd33a91d1dfc1d8ad7f30e84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 19.8MB
        • SHA256 0570d1d3bb043cf8057ba47bf63601ec4230e0645fa381e7f196908b9d71c359
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 19.1MB
        • SHA256 c82b15c67a245c06c4626ecf3701e1902f87365a2a465ac24d64f4371b528ed9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 18.2MB
        • SHA256 072ef2e32bda1107605b89e08f8ed5be4bf4d283b2d57667d8900b2af31035cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 17.3MB
        • SHA256 d7f62f339456b5ee155b149e21ff825bd011cfc3c45cbb114ef5d4a7a065c28e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 18.8MB
        • SHA256 a1e57ed109309323ca1b5c3c48b9347d28bee7fb09c5b108b6e5892a0c2e3dcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 19.4MB
        • SHA256 b38566446ed17e7549828e72efb5fbd57d76f7dcbbf712a51298c15fd96e22bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 17.7MB
        • SHA256 fd9c7d2d5a0cfe2c068f55120e6c1144a1acd565d0fa254c18aab457cc518001
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 15.5MB
        • SHA256 b5ef76b92d66f85e8547f5d6bb6bd42351826b34d13228dd1c3c5db3d01b53ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 15.8MB
        • SHA256 05172a9339abfda8734457ba7fa1123cfc5cb0a88ee128dba6fb3ff4c80c7213
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 15.9MB
        • SHA256 01f4968bcd76243eedb78815aab7fc34c8834266933a59a9efe55b93b14bca92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 16.6MB
        • SHA256 a18575f683340696fa3cc16d08f4916e8d4c3e45a5e495f4b37d674d74499a11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 15.8MB
        • SHA256 e0faf2f94d44945ac8f05821835b7f7367d63bc3b9780373fb8346e6b415e9a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 15.8MB
        • SHA256 9f1fc993f79f6ed7c6d4f12ff1847886e75de28ce007536ba56a0891ff323ddb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 15.4MB
        • SHA256 28cc6f5b23994f3f4628881b0967e7ec9f77ab799c505fcfa716f67b5ac67b01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 16.2MB
        • SHA256 0e3b051ebf3c4bc61c8da9273d47a58bf2b8561af04d8009b0a2cad2823482ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 14.1MB
        • SHA256 4882aca4f4b9a9223029262378e34717f677e09acac30f570fb494d5da580ce8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 14.7MB
        • SHA256 fcf663e1a8c67afb83d195ca9618960692827cc9172868050ab1d586a486487f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 15.0MB
        • SHA256 b0a9b2bc41828c16dd0238833e03c34e89ef7242d4b1e488f00d734c7a8b6c9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 12.9MB
        • SHA256 9b4e4cc35e0b0e89ce9475a3c4cb4e9c48248713917f759eee36c977b1c2d720
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 13.6MB
        • SHA256 03716816050fac5acb4b636e0413637af0f67d59c2f453a0322fa3c3f89253c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 15.1MB
        • SHA256 3ef38ffd166b95e2170d2e06be0e6d035b66289b55728da333bb20a031806f63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 13.4MB
        • SHA256 3d3bc5209a8f38ef4b3b8bafb159e6e2e07cc03f5fcc23614e4e1db750e87306
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 14.0MB
        • SHA256 ab88f2fb1b65e63a9ecf150a1f3703d422fba2e7bd25e8985faf4ceeb82d88ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 30.4MB
        • SHA256 33ccd9af41698c13d62bf47881b0b77c72e8dfbb6c761aba08285040b5ecbaad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/416-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3728-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3728-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download