Overview

overview

8

Static

static

3

2026-08-05...wk.exe

windows10-2004-x64

8

2026-08-05...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/08/2026, 18:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-05_57c36f82c94c6131cdecdd75e195fcd6_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 9.6MB
  • Sample260805-w6k8batdnc
  • SHA256 19a043341580df27fe9e8e631d94eafa94c7e147f767397eaa35363bc9bf1698
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_57c36f82c94c6131cdecdd75e195fcd6_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_57c36f82c94c6131cdecdd75e195fcd6_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5312
  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_57c36f82c94c6131cdecdd75e195fcd6_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-05_57c36f82c94c6131cdecdd75e195fcd6_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4040

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 19.6MB
        • SHA256 2f77180dd89ce3873c8cbf071906bba088427c7257e4ba56c0c039139a37c0cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 19.3MB
        • SHA256 01da2aed1e882b4a967ada2ae65ffb25cc3ef7c46487fedec3f1af77c6745d0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 23.4MB
        • SHA256 8515c62862c08ba2644d77fd645d1ab8be4d48d45fcebfa46c0c289ef6df3f6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 42.8MB
        • SHA256 6f98363bf6ef33c60bbfbb9ec11b14ada88f965ad904d6e2f1758fc535a238c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 11.8MB
        • SHA256 f6408fc2012a3babc51163a7ced9141b919c6246ffd34e9e2e46b213d88d060c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 25.4MB
        • SHA256 25b40ce46daa3dd0f1bf9ac1f7b0f843d748bdaaec3bd2a667e09c2b3e502f5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 21.0MB
        • SHA256 73b0621d9e5758c65b2ea3f5b176403a799734071e4c4c697b7121485769bb1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 22.8MB
        • SHA256 6c6cfc99889ce172f2da09cc5071fe8f6985a52c8c68a659bdd0f850ae9aa1d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 21.6MB
        • SHA256 6141e05b2945142004859485eb395c980bc45983525c80568a7dfc4cc89997df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 20.9MB
        • SHA256 60726bbbc581cb017daa0022439cdd168cb42f4bf81c0377c451e5a5ddb3940c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 21.1MB
        • SHA256 5668300bff073e3f74be175c4c015b3a9044ee3f2677601f98a673c1428f8f0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 22.4MB
        • SHA256 2b967d4f701ecf5d82534a80450f2cc727ef147c05f545ab88b13a0e471194aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 19.3MB
        • SHA256 32f3bcb9a4c92f5cfd7aa79646083444517db0daad45770c4748c75384ab283e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 19.3MB
        • SHA256 694f02b9022666462d1d9bcbb25d153aa055abc8af80f1c4ba9659fed6428ae4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 19.3MB
        • SHA256 03a13f6dc75e60b48680a7d7ea5c34c5aafd9d431e419523a5ff0150a46013c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 19.3MB
        • SHA256 9b94d939fcae7f68aed722e825dc8b4d968dfec270e85afce9a023a81ecbcf81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 19.3MB
        • SHA256 60518e5ab1d011092e490eeed58e9644659b826732360893e3d79257757095f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 19.3MB
        • SHA256 9081a01b1da117a5c3bcba47ed963ed05bdfd3e0d7342087d4c0ce6efdb900dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 19.3MB
        • SHA256 b2c8f3d258f7f9c8efc3653aeb3390a40eaba5f3658f00f41028ae564476e2e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 19.3MB
        • SHA256 ac3089b5cd7e616bac32c814c7a1b28f9d90094a8f25878164737152f5580a05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 19.3MB
        • SHA256 5875cc32959bc07ad4b9eb17be774168eb4f63c8e419e98b4fb9956ee59a8765
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 19.5MB
        • SHA256 9253824a5f502023a28ca45d6bc12d785b979f530bfea3ac6bfd2d9a4f6e6128
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 19.3MB
        • SHA256 b9784bf94f25a31c64fa27d733e7b9390d144eb930dc6e99dca1795575a72af4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 19.3MB
        • SHA256 c2c359c6a650cc8ae99604f2754d66b1843e3c409925e8ea620db82681f36da3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 19.5MB
        • SHA256 f0e8043be7b3de7c35a5400d5b370a59df6e726590c586cde00b08d3e26225b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 19.6MB
        • SHA256 879a91cccd38229687fde264d6cb16c76a94a6792a77f662adcba18ac3260031
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 19.7MB
        • SHA256 106f89b1719f5e0ea1669c73176297acd5e8672edd08dbfe281ce66006592a38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 19.3MB
        • SHA256 c6a0339087d5e51a21d5d036f7622573234d57cc0cdb9d99502151c3a398026b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 19.3MB
        • SHA256 95b13c9f4d295a9589f943a8f032129f53e9149892704547c13dbe71a2cad546
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 19.3MB
        • SHA256 52571244e557474a6701bdf1b5802784fec80a3723e969b9f95d15090e995210
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 19.3MB
        • SHA256 989c658c9cfeb8b894f0601915b3e25c0191ce6f7fa85b7abbd4f96c11bc397d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 19.3MB
        • SHA256 6febbf6842beb943e8c1091013a4c8f70c7345999e5a9fc3f6e1e0036ec7fc75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 19.3MB
        • SHA256 3340d3dc365cdb66e51450b14dc7aa66ff87f7b0f229fa277e93828671589b02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 19.3MB
        • SHA256 439d471d69537152e6ebfd05cf1edf0951a94fc10094b38f76acf025fb8f0511
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 19.3MB
        • SHA256 de5d79f8eac078061e7d46a9332c1e14da39debba06f4c649ba8abda0e17d813
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 19.3MB
        • SHA256 07bc9440c6638afc176a933b5beded3b1324268edea31f6fe405013162686564
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 19.3MB
        • SHA256 837f528f12d2967efdf04a46227e858e773db956a7defea31d2c39cdc0a1cc35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 19.3MB
        • SHA256 88665831c21fd9a9bc75ddbff6453fb46fa1338ceccda8a208ca6907aa28db24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 19.3MB
        • SHA256 0b5e5b6b2f8d9ef3540bb68aab2c831eea366819c10175decb800cd6b598ba19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 9.7MB
        • SHA256 08e4ba27fe1eeec0ec587c9a6533fa97a08d5101cd743745df3da7796cca9ddf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 19.3MB
        • SHA256 60f7512d01ca07399b7752cc77f10b2360819622156ade9b7f4775b857282d12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 19.3MB
        • SHA256 73d9fe9394d7fe9bef7455828d513f4c602edaed8a2260acef617251855dfd73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 19.3MB
        • SHA256 d0b61f2d339f6f242416ed18e10d69bd0883c632467bae7f38928d118b462f88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 19.3MB
        • SHA256 b35aa233261470405725f24a559d7a86929ca8440a47091d344fb9b07b81ef4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.3MB
        • SHA256 96be8130db6aeaa516b9d0d80985aef52b675a9466bb5448b5b7932d8196ecc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 19.3MB
        • SHA256 750df51834a954c6251b2b6086da71ae5dcaeefb00988eb630e0cac601b50c75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 19.3MB
        • SHA256 0f0a9c3663863a0adaf5006fab2fa7cbb342a17372280348d8f31494cb6a420c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 19.3MB
        • SHA256 b4f2a18fcef3849e25436f52de53f4f4af3eb44c51c2e5a4d0be16d8cba6bd06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 19.3MB
        • SHA256 bb8e02c6c969a42a6e9257163373dbfe7649df9622e7ebc00b01bb4d3b603932
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 19.3MB
        • SHA256 c3a6f0ec4b1eca0f24f990bf25dd468929190842eedfeaf1f7b803961c1b5033
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 19.3MB
        • SHA256 95b2f9b77b85d2a56a1a68fbdcd9235d3643573626244d18ce3bf38ea1333cab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 19.3MB
        • SHA256 e8c8a885e6820a93561ec8b1dc3d4a563b18f1b5f7c6a99faed39d92a0de80f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 19.3MB
        • SHA256 a0d25a7ea1dabab1868162ddf306a6b62847575b2fce81edd0be82d539332dca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 19.3MB
        • SHA256 1edb9d716cebd70dc61a72efab2619263b88924f866d8b84c1f4a89bb6dc25e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 19.3MB
        • SHA256 7de089411a31ece2871ebbe21b8f47863d456738e31051cb707e0316692f394d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 19.4MB
        • SHA256 9af3bb9767002d94c0ec4da769d4101f470291ce504c6d5ddceca46f811a6b40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 19.4MB
        • SHA256 6ca8cabdaed8854c5e4998b328273ba9549364f3366b25a2a225cdffef5c0df0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 19.4MB
        • SHA256 d30376a47f54616e8f0c38ee6b990a9a785c86bdc7db0ef76dd3c2baadcd2e26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download