Overview

overview

8

Static

static

3

2026-08-05...wk.exe

windows10-2004-x64

8

2026-08-05...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/08/2026, 19:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-05_03dacf2fbae168176a7a019088089b67_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 7.6MB
  • Sample260805-x32xbsvbqe
  • SHA256 d1db5665b91f3a0695aabb98405fa90469f5dae53b98b66a6205e1753da99af5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_03dacf2fbae168176a7a019088089b67_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_03dacf2fbae168176a7a019088089b67_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4064
  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_03dacf2fbae168176a7a019088089b67_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-05_03dacf2fbae168176a7a019088089b67_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5496

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 8.5MB
        • SHA256 56eaaae7db437da79d76226f15ea9976d027a5e2f6b202833f2e1df6441986a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.2MB
        • SHA256 4d64e5c617ecc0d461cea9dddd2f2f3b6b8c5a39af0a7800c8d9a897efa111f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 15.2MB
        • SHA256 edfc393f75f8e4181e994204fd82b97ae5e2893117cfcd49b36335759a8a2d4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.4MB
        • SHA256 95ca8cf2fb1f91a6a4b1ef824f82940fce6f6002255d74c28f1fbec23a628102
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 15.2MB
        • SHA256 fe2f2ec49d9ce5c5fda9bbd2cfb54a0fa32138e7b37f270be715f9a537e9a730
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 19.2MB
        • SHA256 1c04b302ce84f23cfb8142e6bdcd35cd5539fc0423cbca002e05635056a4119d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 15.5MB
        • SHA256 27da8fbfef91c9e0b83ad43bf0435f3c58fda67b0d2b7a15d476a64a853dea3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 38.6MB
        • SHA256 e5ad031fc1bb40c6a8f291224743590ed9616657700ff68b0c9dcef04f3d452d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.3MB
        • SHA256 2c6be433e7fe4a1753bf108ca53df57453c62dd66784b4c582d11cd3fa04d71f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 15.2MB
        • SHA256 47ca677fe64009060eb2466172ba3580ed4be52b5312e6f2ff175a8cb6ca3ad9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 21.2MB
        • SHA256 a3d3f4e9e1e7c4e1ef8c2ddba99ecfb2b91353e21fa5fa51eca32a0ac2867254
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 16.9MB
        • SHA256 c9d5d7f9f95c6190986be020069a4f8ef462db2e195f657c13042479e66ec215
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 18.6MB
        • SHA256 560e5f84ee45345009137cf02357e51beb03777b36cf4b5e0bee1ce336a5db72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 17.4MB
        • SHA256 81692c0b25f578c7e4eeec164078a2d1ff35b258fdebade14848a2e75a449ac3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 16.8MB
        • SHA256 528326faa3019547ac04cb9671a228da6a803128afdad0de83fd02ebd5640d90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 17.0MB
        • SHA256 172f8be0dd15051659399c6a8b7311ad5c7c71dc1b052b2c51f586b51e4431de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 18.2MB
        • SHA256 3416e0b273d8ef9d3aa2d1090270e2c7c676f311e6ec494f5136e0a6bbec49a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 16.6MB
        • SHA256 d0ffbb49ca376959689778c0dcf867b2502d5354bfffaf7ce894ace3cbae487d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 15.2MB
        • SHA256 4cd5a006eff9dc75bf9a6720423cf27300726c8dcdbea4a2cc02cd4060c5ec92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 15.2MB
        • SHA256 5c54a14c9b60b13499f85762cef05e9d3115a0cf17a5a528aeec121520d90ceb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 15.2MB
        • SHA256 e90b2a6033f6ea6f5b0d065d43a4009f14990453a86005f1dfcd07139daeb6f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 15.2MB
        • SHA256 6dd793243d18e7f1c4ae7083850bf9de7e781c7ee7601e936227257aad30e9d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 15.2MB
        • SHA256 d7ca24621132e481a8a8420448c18925e8f611d2899f5662a51c6fe6da8d9d60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 7.6MB
        • SHA256 2e7f0ca5c85ad07748a47424bc9aeac055c8f414e13c0d342e94a92da1a52369
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 15.2MB
        • SHA256 085c8df250a9ef27a737d66d1f7fec7f939a5a31294d6c48dad8fabc299be660
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 15.4MB
        • SHA256 09b880370e2e45c64341dc2ac0055eedc69d4916806ea8329f18f2420d274218
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 15.2MB
        • SHA256 b0499e593adb2080f1b903a42215d762345408e594694ad8389e5e3d70664790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 15.2MB
        • SHA256 958e8bb7c187d246ac6615b9e2b173a200aba6cfb6afcf9e7961e8f7c912aaf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 15.3MB
        • SHA256 f3b7d1deedd645a5614296d0d9e69ebaada6c7321d5b5dbca1e35e581e78f697
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 15.2MB
        • SHA256 4e6e68c3dcd94ccdab5fd73d1f05284caece7cbefa33e01268494f748fe9ecf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 15.2MB
        • SHA256 9fe6d8d4680e095157024d45c447530dafa2f4c12a5a805e0fe5b1d56339df25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 15.3MB
        • SHA256 40b159326c7d46f32a311b82c5c2b62eaff453dcb89669ad071032c2927e47db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 15.4MB
        • SHA256 ccd53473eae7f4a1b622bcf89bffcdc519ab02c70cd76155258fdfdc00c9eb24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 15.2MB
        • SHA256 c29847e78eb1b1221df2f4b19f9890e8693e9f610c76c472c832504d50b279ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 15.2MB
        • SHA256 db0ad12f15b4601a3f77a9d65a60e9e43b00bba0d60a08665b48dd9397fe9398
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 15.2MB
        • SHA256 d4e580602891f0f59453821de3cf1fd30ad5b03669d7e89a03efab3b62951785
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 15.2MB
        • SHA256 8314bbfd8ff2af35eaa6946341712c2c248dcb88b11540863c1c092ef59387c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 15.2MB
        • SHA256 0454525173a61774efada237ec78713c69e879594aecaa332ed2ec625312ad95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 15.2MB
        • SHA256 88e93d18a7518e76b99c2902f7ea598fc47753ccd2f440e388d84b9a76270638
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 15.2MB
        • SHA256 3b4b3a63ef24ffe86780cbbdb327446d6dd7a095a25cf50774218f0c43c75b57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 15.2MB
        • SHA256 cb09e96f61ea7eacbd2b689efc56d31630a146e53215252b69c0dddc133223b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 15.2MB
        • SHA256 e4668f40f084b7a31d58b8f8ecabc5b5621a3eb512800324c637b0ffa8bdebe7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 15.2MB
        • SHA256 1fc23110b0a87a1674b8817d160ebecb924173fadfea9f4b88a52c3e10e8fc1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 15.2MB
        • SHA256 ad6cbf1d8f3d41a6a6d860fe81fe1cd51fcf9d3bb216cc93fb8726093ffd63dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 15.2MB
        • SHA256 38564ab95013489671dd6f9a312538b7269eeebb50f0dc3b76ae33efc39e0376
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 15.2MB
        • SHA256 f99c40d673b8d55ca271a8809933d6cd03dd5d55073f7c33dd34c0acd30f8a7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 15.2MB
        • SHA256 f89e0c1fc93e2c1e106496d7073c5e416b994ce739aeee3ac704564cf2fd6326
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 15.2MB
        • SHA256 9ec9c84b40842c0396b7259b253803fc2deb0dca97c059fd2413b344fd3bd38e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 15.2MB
        • SHA256 7aaa11879eb361abd0b9dbcede5684defd2cc7929eb87d4da4305de4226212de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 15.2MB
        • SHA256 e48134ce8475c4154dd26a73ba77f8d7091c79c715a10db66e457425704bdaf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 15.2MB
        • SHA256 2ce831072f4c5f595f34a5dac265ff56cccb3edb1aeb52de0560fbee3f77d41a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 15.2MB
        • SHA256 4af421b85f979a23b81dfd834f6c24ed44577301dfad33127959ca2f533540cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 15.2MB
        • SHA256 b423f33d4e4dc2e97e5bebb91a20b842bbcae531f9d17bae2b282e2a590e90d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 15.2MB
        • SHA256 e64c25775e740937b6ab5ffdc8ee11a5709ad469ff7d6cf5b5519b108c56519f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 15.2MB
        • SHA256 f152e4aea7b4f220d9e1eca643a8314b9ba1981bd3e5671e2cf88f8b4a5f897a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 15.2MB
        • SHA256 91c9b52a9cda59285222c224ddf3a6530dfed92a801d35807f677e5590efc6fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 15.2MB
        • SHA256 f0ff792e9e5ae60bfceb6e4fe63d81abd4147360e354e5c3274d6dc09ac3b163
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 15.2MB
        • SHA256 21cde5e7b01756e84876e34e9800044a2e711f198eaf4e2e3840239f42434f89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 15.3MB
        • SHA256 ba580949b2470bf2f65b8e988b75be046d95519dab70ca2d30c86f847b2f6d5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 15.2MB
        • SHA256 40a015ab89c27a1cfa569a9e005ce3124eeb460897d24d40748dd06af1994c95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 15.2MB
        • SHA256 3f559bf00ea8f1ceef05cfba9defdbc78eefc2f81d2769a08f7f1a979435556f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 15.2MB
        • SHA256 e38abe6e91406679e17e5c72245793507f410150c84ad046cf5b46c4839ad5dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download