Overview

overview

8

Static

static

3

2026-08-05...wk.exe

windows10-2004-x64

8

2026-08-05...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/08/2026, 18:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-05_79538a59a993f297fdd79f30913a818f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 7.8MB
  • Sample260805-wt77baytev
  • SHA256 add0ca0ffea77c580dabb7611bfebc54edbca3cba61ea627cff180136ef24cda
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_79538a59a993f297fdd79f30913a818f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_79538a59a993f297fdd79f30913a818f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5904
  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_79538a59a993f297fdd79f30913a818f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-05_79538a59a993f297fdd79f30913a818f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3716

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.5MB
        • SHA256 3777aac7d30def9da49a37aec634970c507be559ff447cc648fa640c316a490c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 15.6MB
        • SHA256 0c51a310d4460a1b092440b3c868a42bb7f40886cf46c8c973ec7841845ec080
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.9MB
        • SHA256 369da72c90f66276e67d96876fc2dadb1d4ba7898bf33975e81895152d3ddb69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 15.6MB
        • SHA256 264a9db1c16c84f8ccb6bd837e895877937e81a8b37a29f2051648922a87972a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 19.7MB
        • SHA256 81eaa99f523ac442bec0995f44e65ccfbc05717d2d593593db1f12aebb3e6193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 15.9MB
        • SHA256 63f14510c55f182c3c1e46e4a73d96e6132b83f31337e4f68515e0985a55d45c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.7MB
        • SHA256 51fe5ead29e632b1faee607d4c1e434abe5e917a1b18a8514b077b94ddb24120
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 15.7MB
        • SHA256 6c823f4ea559d1ec641d22663f9d877e3b7494f02299200532845dcb20c2b1ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 21.7MB
        • SHA256 d8034711cd42eaf947f52d781c6cf7116f311cef23156fcaf0940be5ed46a635
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 7.8MB
        • SHA256 add0ca0ffea77c580dabb7611bfebc54edbca3cba61ea627cff180136ef24cda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 19.1MB
        • SHA256 bfc50ff375afc2aa24a7e43cdb6f7de2c345f30f99d353ffc883b6178abe47db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 17.9MB
        • SHA256 7d578a8f8a3942d43c6313a8764f6286e2ce9db0ba69a918c8b05cae96e83c9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 17.2MB
        • SHA256 913ae1065ff9f6fc66cf468923735863e565ba832a2529f86ae75503e1909ce1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 17.4MB
        • SHA256 1d4ed2b4aedd766887a1ddfef2280a4da692e32dce940753bfb85346b540f023
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 18.7MB
        • SHA256 ccd77e8a33b33b030a8c547cef353ce0883bc399c3c2433f5c8dce638facddd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 17.0MB
        • SHA256 a210502468a153b9aff511c651f0061493f69936ab4207bfa97b9b25fb136310
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 15.6MB
        • SHA256 9ab31393d70d6f7ddb3cd37882f66b8dc89c545996842e20bd8d5788e062e0f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 15.6MB
        • SHA256 cbad3df60b48d05232b5866158712ee3b52a741f596e4279d7b936f8688d9f08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 15.6MB
        • SHA256 4bac96181358e2ae65dde3ee59341c5057a16e81e894f0541cfd0f81a04bf9ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 15.6MB
        • SHA256 84131abcf6d2ae7495a2f8e9f2afc92b969b5425cd019be2766334d7611027ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 64KB
        • SHA256 5ee579a102ce5bf0cbd0019815419a15a91d52dccc5939636170e988272f403c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 15.6MB
        • SHA256 e35e324356139968d93051ee45d94b8f1e067f7bc33e64db112f2e664267788a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 15.6MB
        • SHA256 beef0a0925709bd82ee0336c1325b902cf900b3ead0cb5003986d1fbe545fc7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 15.9MB
        • SHA256 70dfe77ec5b1e528f76e237c09480ec09cbd9b421f09ae333a3b7f60ec9489aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 15.6MB
        • SHA256 40df1ba9d3c5a3fc09a742aecd6b7c39d62a8f3f74b5739b402fa7cf9914d1bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 15.8MB
        • SHA256 e62d061ba59d4ece51d4fa0ab4524b45a176b44ae4217341bb80481b68b7bd1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 15.6MB
        • SHA256 f2b5bdc22c0403e412a05026bdbf9fc6665507b03f0245967673ae0ae43b4b19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 15.6MB
        • SHA256 5d79b29e7953462a83433fb0b0c5764a569808f780552977724ea7201e045ad5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 15.8MB
        • SHA256 20cbd9f93dfa529abf29f474d699c56359900ffceca7586019b573b0e13c9245
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 15.9MB
        • SHA256 8e12532ab97977d6d56218e9d510f97147d3abb604a4723971372a12fbf22ef0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 16.0MB
        • SHA256 0030c24df78197a2be4339d00901e81cae28259ed2c698e56c214dee9fd54ea6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 15.6MB
        • SHA256 2b0dc3e321ff80a4f3396f722f5b4da71b7bcc7859a063d60875938382b8df29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 15.6MB
        • SHA256 b548018510cd57723d99bdd36ca091bc3393d402b60bfd92bdcea70d71df332b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 15.6MB
        • SHA256 aefb719d151d71f41fdc85aaab3daca8985eaf88c2e0963abf5a71fa9a700948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 15.6MB
        • SHA256 4f704e97fbeb23c78222b578a6afccfb013bc8d12a614badf995579e3b5acf93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 15.6MB
        • SHA256 24df49b58db14c7e8cc8ab3728f8ca3e383152f527274ac28bf99bee3357e1ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 15.6MB
        • SHA256 3d6cf1b94673b9d3373e5835291425deb573a42624037c8d61c27f43e9e942ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 15.6MB
        • SHA256 5621a1924a8818261f24fc2b5f75f34d6ed252108dba051aaab5e6e68417acf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 15.6MB
        • SHA256 713f72f97ca7056123b3a7443e8b9d44b6ae7a0067461b1db2955f556e00c98f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 15.6MB
        • SHA256 089cb3454ecaca2a11da10562755af3e01dcd2be9e7cf320bb9b27dc7f498496
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 15.6MB
        • SHA256 d2b9d4d438dc6d19dcb75d4585e2e2e251e79d9f0b7d670a047100fa589c2699
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 15.6MB
        • SHA256 5a674c7d73ad169574da13b83fc6cf9af02d8381e06f76648c176ec2b9e3e24c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 15.6MB
        • SHA256 bab5613cf34cc52072a34b9f914e1ce2d6f2aeddb855d1068b5b9a406bc32882
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 15.6MB
        • SHA256 4fac82c00fdf31c23613a6bb0ccbaaadcf7a6ddee05365af4e9923935322ab50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 15.6MB
        • SHA256 8fba1b3634ca8dbf3ef550c1cd544b1534ddac145864ea8a9b4c299b1bc8eff8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 15.6MB
        • SHA256 de12cebf379bff010306906506e4387e08672d75d9b8dbf56ee3e0b684ec6c94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 15.6MB
        • SHA256 80d38be9342c0778e8b695ab8bd7af607a60c3b971eb3c1874ae0be26d9714fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 15.6MB
        • SHA256 92d1e94f09a56d36616e6aa551723f0464c20db1eba14512ea7c1ac55383a636
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 15.6MB
        • SHA256 2c2c41e2c381ce469c3ee03d25e92741d735758e442be85a3687a2ed4d619a1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 15.6MB
        • SHA256 4ed3af03c5ad72dc3f5556d575db4a290e16338eb146064c8be0ab4513d003d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 15.6MB
        • SHA256 bdaf9531d08ec4e2b75bf20c465457a3732c7b2b23fe61f93e4814db6b8360fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 15.6MB
        • SHA256 ac7d63ccc4e436fa26e35f24f23f9b921eb12f892964c2ac2f400f50d5cd34c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 15.6MB
        • SHA256 878f389be7017185a7b5d4caf8d9e7fc7ddda8a764cb9cfa892dc575134af8e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 15.6MB
        • SHA256 0909803ef84edfa5e825bdee5e427d81057565de6bb67b24a85b32b49a20a084
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 15.6MB
        • SHA256 104c166266a192ed833fefd6368e9749ffe302b52edb79a7c0f3dea806656709
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 15.6MB
        • SHA256 4385a890d9253421c493ac0c3bd0c1a326c063c48f030d3e00b1da6a9d75f44a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 15.6MB
        • SHA256 8963ef76e9addd34db94ae61ac59c251fe96fd48eb29ea9cdba13e17218ccebb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 15.7MB
        • SHA256 6898c3419d32ef6510dac29494f8c0ba86a8fa0622edcac1ec2b3f73e17860cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 15.7MB
        • SHA256 706654960dbd40073cbe77b30cfb70fd617108250b594922c13624492692e5f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 15.7MB
        • SHA256 f9de8b7cdba508835aabe8c3010ac6f445445e67a7fcc0b842f6331d399e6064
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 15.7MB
        • SHA256 eb9fcda453dbdeea58d33b811ecc9c86b6ef867a4515cc1f457938a2148dfb5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download