Overview

overview

8

Static

static

3

2026-08-05...wk.exe

windows10-2004-x64

8

2026-08-05...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    05/08/2026, 17:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-05_de6c292d5e0fba55271c459bc454ec32_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 9.8MB
  • Sample260805-vtsk7a1hle
  • SHA256 59ef219a379c50a8be8c44880d083f2519b522eda7b6e8fbab3b5d4fd88101d7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_de6c292d5e0fba55271c459bc454ec32_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_de6c292d5e0fba55271c459bc454ec32_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4876
  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_de6c292d5e0fba55271c459bc454ec32_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-05_de6c292d5e0fba55271c459bc454ec32_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4736

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 20.2MB
        • SHA256 60a1a58de67347b0b798221892eda01945a8310d50c3cbab3eecee15070d8ccc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 20.6MB
        • SHA256 49ab872caefb15b241eaf2922d25db73c71b447057d6bf18f8774bc4c350d5b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 20.3MB
        • SHA256 e192925464bab8893782e4c3184a2b8df6bb023417668e9d7dca58e188c5d9f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 19.7MB
        • SHA256 69206bc6e0cc981e1eb1c9eb550d1d4f89d2c031b61c41b591f1d6f2406dc2e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 19.9MB
        • SHA256 88b6a17622b150e6f86ed637783912d772ee8071be1ac0472d1f919e0392214f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 19.7MB
        • SHA256 9a8f754e63a5039e713a3e052777e1342472edfd7ee26e57a2ed3a1f79be7171
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 23.7MB
        • SHA256 4d4a09eb7b69348f76cafb24cd8d57d166e9f2bbc1c21264fb9e88d8649199c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 20.0MB
        • SHA256 a5cf2dc1139bb36eb98e9996116b0e4f287d16534ba8131ba2a6eab555b06d7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 21.8MB
        • SHA256 ac253ef8687b9741adfb32380ec9bbfc417fda20e4c8cf21740c40da6cd120a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 19.7MB
        • SHA256 55bdc5d3735571408ca0ac7117b1a0bb83c9e4c41f68795d88766dc17134ec53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 25.7MB
        • SHA256 a0062741a294c518ec56cb64523c1c26639b5ba71b29024f2c1723e507796aa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 21.4MB
        • SHA256 1488586e0aee543c23bf4dec58fb98e433dcb7baf5d12cdef7990553ce457ad8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 23.1MB
        • SHA256 71f346c62eeebedc05f6d6327db97f42e4f6da24423f38054f8c2a472b563b82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 21.9MB
        • SHA256 06e295df7221201735b3dbefd8e625025e7db31a2ea458b8f37051c19f8af77c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 21.3MB
        • SHA256 3c3c913acd23cf71e94033ec3e670d60646de6ec5a279e697e3408ac5532c1bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 21.5MB
        • SHA256 ce3c2af2cd7afed86e94cb2fecf31213724a32c6d00b9a1546a36fcb6290929e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 22.7MB
        • SHA256 6573aeb42f8e9e6c109d8180f238e92b0b26a32583c11cd327cabf8ae70170fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 21.1MB
        • SHA256 c8c679033a4f677261a8601bdee64247b63418bc4985f0cd0ea91590e88b8ab3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 19.7MB
        • SHA256 2fe03f27a98c07a531271814cee9178c18311c03c87562532785788dc484e3d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 19.7MB
        • SHA256 13b3102f8cbbfb73ab8a67044d4a0c18906472354d774e295c21eac85c10c797
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 19.7MB
        • SHA256 41eb59f9cc7daa3a77a303790271dabfb58e7166ca2baf859e9ff221bbb97000
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 19.7MB
        • SHA256 058a5de5623858702e47fddab4028869c651bdb3f04685735e0cc5996c5051d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 19.7MB
        • SHA256 f5a7cd798bdeb06ef2f988b166692aa5c434a9bbbd9fe450318c2f4841a9e71a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 19.7MB
        • SHA256 d89d5bb26ad0131d1987b1ec97199e8267886a85a48e69959c0b5a4fcf19e81c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 19.7MB
        • SHA256 77d7bb4018cb157f7cf27972bfdd0931832d45881b80d7a5a1f143d6afccadbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 19.7MB
        • SHA256 00d742e72bb1cba3793b255cac7365a8dda560493789f6b1bf89d1ff7548cc18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 19.7MB
        • SHA256 1beb6b5d5ce2e43e23be8da46d6bbc4b1c8f8ed584adaeb554a23e723c88dc65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 19.8MB
        • SHA256 e2b0034003cbfe3e658a6f56070e088759b1bbbdf200c5445055d0e77f574a87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 19.7MB
        • SHA256 1a3263d1ddca24410d701029fe9fa62ae9c79e383ba3d92332565621bbdc512b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 19.8MB
        • SHA256 b39d3b0fb4438258ce5aab8dc4758c1d69ff52bc1a6f25e2c536a56b0af0b8a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 19.9MB
        • SHA256 b535e61703c1bf1c1733e974fa306ecfe3554cda77316c81ce57fd7b709f85c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 20.1MB
        • SHA256 a29e7aec9d0511743e0f721864e2928d491b10c1ae0b076b205d1a42804e0e25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 19.7MB
        • SHA256 b40b1d70b737c67abb8050a0d33e570761eef41d925487d928defe3ab4226ca2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 19.7MB
        • SHA256 c6eea113202508957a32e8a7f9348e8fd926b94ef9114b2e7b04ed4356f48c34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 19.7MB
        • SHA256 51d7dd16ef82b2b25c53db1d7d51310fd8139ae241def440c2730440bb6f3a28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 19.7MB
        • SHA256 e657445baa22dfe223808fa37ccf999e53117633b7a1bd53e76aebf2eab2d10b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 19.7MB
        • SHA256 03ca96288a3b278c67d4785d98181c36fc4f2ee9f0ce84366948246d8661630e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 19.7MB
        • SHA256 89b45837078b4bebbbc086c5e7f0e089a69448a5179b810b9a49b739562ced2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 19.7MB
        • SHA256 b21b7b5337f256f1accfb1c19b3cb0e598121167c5a33ebbf6cb860539faed73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 19.7MB
        • SHA256 fa985736d98c3d840bddfdecbd36f4e3cb634cea85ff21f37e71b5d96538d9cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 19.7MB
        • SHA256 b81ba40eb4ca57fa69e9deffb1197499af7fe35e1b56acb6e8f513f7843b3b35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 19.7MB
        • SHA256 7556458c7b2dbdc147213d1a81df240fe335eb7b5fc094c233686efa831fb73e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 19.7MB
        • SHA256 a1ae3c6a23da02a83846feafb8dfbb97d074f394c7071f5ce1b1eda349d3004d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 19.7MB
        • SHA256 52ae4152d83e7d032238abc65b7bccc9aee16726def1803b7599195b2deb2d23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 19.7MB
        • SHA256 da8d97e5a42ad67c3a25a847a2d0fb7283f97ad63fd6c4b1331149e2d4a2ae33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 19.7MB
        • SHA256 bbb6863f60bed9f5b31187a12040630ba42cbce14a6b8038a24eada6dca3666f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 19.7MB
        • SHA256 be5a41acf8417c3f8bd4024f9b9db19f41ea602ac1f482bb6237bf16d8b68551
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 19.7MB
        • SHA256 34e8f680e4d2800383b1b7fb576b821197ac8233e4ceafab5169c214663cb13f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.7MB
        • SHA256 bcf09f9a3d47a1674b1c608e4e462645689ceffb6f95fcec10c5e3864870cfb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 19.7MB
        • SHA256 2840d93156697dbce6827f477f7c2f37af94b1023104d5359e0cdea29ca65d1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 19.7MB
        • SHA256 e7a8d316802a9b2bd72d19cb907f87641fd76548ecf38584a3cad6c4dd9ad558
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 19.7MB
        • SHA256 dd22ea8a4edf6f53231c59ac0f3d5861401990b9095c38b9fc413483c16b13fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 19.8MB
        • SHA256 317ec7c425895efadbc095b6d8df493e547915f2e37bbdf4680bd2538ba59f03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 19.7MB
        • SHA256 a1b6c063dc18b026e0e7b83538b6a4ddc3badcbaa84340bf45a57a0822d45d2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 19.7MB
        • SHA256 457ada08d756e630a2d70ac7fac8cdbe3fbf8cdcad312483a0bc25330a34e1f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 19.7MB
        • SHA256 580a2ec9597e14da9f94ea5db1fb3e3a2cc1aa3bcccc3e390e38f0207aa6acb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 9.8MB
        • SHA256 59ef219a379c50a8be8c44880d083f2519b522eda7b6e8fbab3b5d4fd88101d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download