Overview

overview

8

Static

static

3

2026-08-07...wk.exe

windows10-2004-x64

8

2026-08-07...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 01:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_81f4da2ef7a264871d4ff9f35f401aac_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 12.3MB
  • Sample260808-beqnhafj21
  • SHA256 a2e07b217a2bc2c77e589660308e83083329ef74da49bf43fc0be77192113f12
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_81f4da2ef7a264871d4ff9f35f401aac_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_81f4da2ef7a264871d4ff9f35f401aac_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:476
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_81f4da2ef7a264871d4ff9f35f401aac_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_81f4da2ef7a264871d4ff9f35f401aac_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2868

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 12.6MB
        • SHA256 32660d4f81a7a62a2c87089df35fad5f2003c14c7ed84a1a59b5bb5767bfea0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 24.6MB
        • SHA256 44fb849551a604c56efcf6a955e1d845b0df855b1e32c2a69475db256ce43dc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 28.7MB
        • SHA256 112b7e8c770427d3e5dea7a93a078f337a2f76a058830a7c8ed150f9232a11e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 24.9MB
        • SHA256 a804a94f21b3bc006bb8b694e59c17b67f8670040691d0278d36faa3ecb7cdca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 48.0MB
        • SHA256 61c60327ba8299ca428137677aa343b6530def4e0629d8d736836c5970990346
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 14.4MB
        • SHA256 0392529f108f0cac134f41f9268b943846a64d4409cfd3a65c2ac29e91e5ddf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 24.7MB
        • SHA256 e071c736df4f81462c1418baddc7edd5c4ac1b4ad975668e51a08d951cd57725
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 18.3MB
        • SHA256 38819c78a0b50f43c67d1703f6f5246dd6efa0180a83ae8faded0c1cdcdfe7be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 30.6MB
        • SHA256 bf151d24dfe230d99a8a803ac225b9105a3c34e664e620f7f37175ddfb441b9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 26.3MB
        • SHA256 6b0ba5fdab2963bde89bbe9bc0ac856420d6563a55bf2a15b0fe5d47a5c0535a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 28.0MB
        • SHA256 3ab5514765665e25ab9bb889902c23791067088332b6361b44f3e5db9c687b56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 14.5MB
        • SHA256 04bfcc1e15e3fb8be9e676bb91d393617e7f22d587cd20751e58157de43768db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 26.2MB
        • SHA256 982e94737aff65e4701567d749a5eccb3281871be36d56d07260a34610f435b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 26.4MB
        • SHA256 1fd4610ad249a404c55997f1c34eaf5406bd44d448430f475e4a81541ef9e170
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 27.6MB
        • SHA256 651cf339f344bf1fdf36d5f0062ae2209fa99dd0abd3e7ae9e3c668db4968fa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 26.0MB
        • SHA256 837ef207e4023378865c05bb3128c466a07b41d1702943bb99d53c4c54d96c3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 24.6MB
        • SHA256 17efe5894105617ddfe7bd1395b4debe69032cd5e2a76b7e2fd62daa1f0efab4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 24.6MB
        • SHA256 990722cb500b01fe48c297d0eb21df15312507e95d0f9f9d20147e42db2fad12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 24.6MB
        • SHA256 777f5af03ca1882ec0649b4036ce1cdd2d49fb3154dc2dfeb80f52fbcf3fd01e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 24.6MB
        • SHA256 7ef8595596933e0477da8012dde49070fafdb9cafb68714a148c430e46bad9ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 24.6MB
        • SHA256 d94d52db3aadb9278bebdedf2fb786b93519a522b6dd5fd19395f38f4ef4640e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 24.6MB
        • SHA256 c20e5f8339ea0c230b77db02fc61d009e446f5c1ed15a1a48209d9a9c6375cc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 24.6MB
        • SHA256 93bcde07c0a4b88617a16c5648d2033ba6a50b773df7f8a3684d6e6c0e045e25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 24.8MB
        • SHA256 853091e19ae66be02f9aa6a0e7a8de8d3cf73dceacaea82f0206f80d6c142b37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 24.6MB
        • SHA256 04a4f1792ea8dcc37b04198503b79470ea0ea172bbd87de69b69a86dd9217d1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 24.6MB
        • SHA256 fc59ef6da83e0476ff356fd98808ac48022e196dfd7979f38209d9297aceb76b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 24.7MB
        • SHA256 4168e7066ff29cd93e92454cfe7d215af54a89c293f2274ee6e07c2f267cc971
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 24.6MB
        • SHA256 7d014da72f958bc6cfc5703b81fec2c83fc661157e7cda924b634c6023ef6501
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 24.6MB
        • SHA256 5c188d575051a622847c9af7a6467055c3de4b0d049346a4eee2c75da79f2884
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 24.7MB
        • SHA256 b6e5fbae5501a477c16b3aef6167ba4d205dbfea0831cb186d6a515e2915b5c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 24.8MB
        • SHA256 de99c02212cfffdc5e6c67e954d7b931fe02d35b07e66b9244d5e2cae9cdef11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 25.0MB
        • SHA256 89daca7f52520f7a06ab0701040769c5851cd18b8ddedce362dfff3f58d62fd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 24.6MB
        • SHA256 eb120f05e55d8999ca542b827bd7ebf20d0e3be77dcf05506d9a9db9f9079d4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 24.6MB
        • SHA256 1da71ee1bcd637bfbf8949c892bb906d12599a8c769964031ea257420c19e209
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 24.6MB
        • SHA256 3a464ff77c33638cbe2d6760a4a0a47a91325db25dd212a39699798a7253d92c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 24.6MB
        • SHA256 3f909b65d62b72f76ce2c3200421f0092d3671a4474012143aae3cf064434f05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 24.6MB
        • SHA256 4486539659f344bec0c02276ed9f74fc6b7c5b2c822cad7de89e322e2c2827f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 24.6MB
        • SHA256 3bb06b070cb3b738cbda2a57899d3756da444b60700086ae9e5eac058d585fcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 24.6MB
        • SHA256 7c11b8d6028a416fde61b090f4841f0df1c4636114ee54bf0e8a90c50d9ab811
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 24.6MB
        • SHA256 796ca19901d904f3673d53dd2bd08471f8736f2eab79bfc28973216d32c89b9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 24.6MB
        • SHA256 a3b9af4cb6bd35a0897834fd309c621a00be6d7692dcce3a44ead6de078953c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 24.6MB
        • SHA256 0b0f1b69d057dabef6f19f433d0d0dc6ec1d86bf2f10b0e1e07a841a6e71c47b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 24.6MB
        • SHA256 37f9369591038639c72082c0ba277997b4a9f88455dfcda49cfe8bfc4f70115a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 24.6MB
        • SHA256 256746bda02606e6b4c39c6a143c3dd5ba7d0f542d2a4e369d94962926eca1c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 24.6MB
        • SHA256 b476b7fd425518ef8d3569d2bc0df789666e626bf8017eb762be67b52f08bd70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 24.6MB
        • SHA256 ef1c69f7b6ffbc37231a3bcc2ca7c5cc1ab9e107ed4b9c725d081b5b2912fb66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 24.6MB
        • SHA256 61a67e0f2fe1baae94750659541ff9424c365eb5e161b7d25b304d8fc3c5ad19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.6MB
        • SHA256 8d73e93d023ff8036c04ecb75b700b5e92b5cace4ab85252a14a4bc3a9299a04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 24.6MB
        • SHA256 b9ba1dddae6437ad46b6e3ad95edcfcc83b284b16c396066b56df17df921b88e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 24.6MB
        • SHA256 dd52c339ba493d76d5cbd6dabb1c5c1c66f3f920d0399b3bc75f8c6cc20a0771
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 24.6MB
        • SHA256 affbe86abc44ecdcf370140e6bf49ff0c134b02b720896c27d65130551113fae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 24.6MB
        • SHA256 7ffc244f9391744e5c130cd513c87bea021970e71d94a1ec9e91e543db0eb10a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 24.6MB
        • SHA256 563ade976d85f3b2aa720fa1301be40173a7fc0e6c08ec212bb93253c81b392b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 24.6MB
        • SHA256 9b43bfc4a919571cab89a53c4606d4c855e2f3fc523a12ede6ee6022be8ae9f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 24.6MB
        • SHA256 e29728ebeb74f3638f8501984e1623f4ce330be464f6a97df44fdcaa59617554
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 24.6MB
        • SHA256 9e2804682c29d1ff8a6876b0b751d80c649dc212215a104879ae02119702e403
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 24.6MB
        • SHA256 c71e6073ed172f62820d02f9e8a195f6d64ead335ef04eca7a778022f1b9d56f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 24.6MB
        • SHA256 d95a4f9d9f053399612b021cbc75b2f8e60307705050523708a9dde67135113a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 24.6MB
        • SHA256 63232c2727bc7df6bdc4e6a6898a264110183ca280267131023c526f2e3db7b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 24.7MB
        • SHA256 33ad734ef2a5a6fee32d46822cd7de1bca0c93b114731a51996c543e9e6fcc02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 24.6MB
        • SHA256 a72ba99c750088f1e50aeb4e2027d0cc0e9bd4b54e8429282b4a80c15e85e274
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 24.6MB
        • SHA256 6135f086dbda7d8e853cb64f92b80537258cb3982fd395b937e58d688ccf100b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 24.6MB
        • SHA256 11ab51d1fb6249a5422ca554b31c8c6731c66355a6e9ad787a1f4a409eb951ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download