Overview

overview

8

Static

static

3

2026-08-08...wk.exe

windows10-2004-x64

8

2026-08-08...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    93s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 17:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_d283057d502a3d4d80eb0ffea2368fee_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 38.9MB
  • Sample260808-vrt18san8s
  • SHA256 c569315dc94630e44f3abbca48eebb621cfcd141087a2e4d72d90967464d4391
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_d283057d502a3d4d80eb0ffea2368fee_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_d283057d502a3d4d80eb0ffea2368fee_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6000
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_d283057d502a3d4d80eb0ffea2368fee_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_d283057d502a3d4d80eb0ffea2368fee_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3148

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 39.2MB
        • SHA256 5402e33dd7de8ad11501ed914a78c354191ddeba5fe07a1e809d96ca9a09b9a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 77.9MB
        • SHA256 c829f4d37e020edd13d9a68f7c88ca613cbf4eb6dbfafc075861117f7b246167
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 82.0MB
        • SHA256 8de601374d6c1cc519056ba22dac5124d8ba0193a3e1cd73b29a3cad3f1d1f07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 78.2MB
        • SHA256 822e0bc0131f659ae83ba4a7004171f85c624d825c1ff112f6baf2f9eeac54d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 41.1MB
        • SHA256 86bc7807ea643d8d03f38d83c90709997fe448daca1f9fb4cba7a919124806b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 78.0MB
        • SHA256 8317aaa8ca90e8d8a050d622db97c9f000adf26a719f3f216005e605d0c60fae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 82.1MB
        • SHA256 629f7fdc6a476d58bc4b1b85b8031ca73aeb8ebbe903d4f9361e730d42aee3bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 74.9MB
        • SHA256 8f52eaea7a2822bb33afa314cb808771462613fa0d69df85236d2bdd2b35a306
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 79.6MB
        • SHA256 b1066af2d8da5921a041836a62e63dae59d0bd015ffdc9337a9feb5d534c9093
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 81.3MB
        • SHA256 578120569a13482feabee28d1775c3a419558ec3f9652ff2b2b24b4b8482cb97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 80.2MB
        • SHA256 d8428e79013bbe0929367750fb24bc14d5c2efa3e227189af9a32054ed0d7d9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 70.7MB
        • SHA256 d83baaf06df18b0f32de56a26604eae8ff37afbcb9c385a0aaaaeb6c5973fbff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 69.3MB
        • SHA256 b4ee9d6dd195d29ae0583bc37184179ac24aa23016c39d997b80027708d2d614
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 68.9MB
        • SHA256 cf83709cafbd6db41c336dd6e3bf3991e0a6eafb3e3ba765842a0efc2bb9a595
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 67.6MB
        • SHA256 b0b098ac197da6309cb84e30b03bc6a6d44920679af3bec0f2b9577b537c524c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 66.1MB
        • SHA256 6ab1f45a5251ec940bf70db8e969754f5da03e0408b009bc0c50245d84da564d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 64.9MB
        • SHA256 a283573eb6687848b9309f6c4e0a7e5f7964b5b7d5cd036465c67e47ba97a692
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 60.7MB
        • SHA256 d55e8c270f6d4a0072072e9b7f29961d283cfabe11f448c7f5590dd42acbfb88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 58.6MB
        • SHA256 cb6303e31d549879b886ef88fcdb211cd2c0666b398cbfbfd2e07ba3c0ada955
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 59.5MB
        • SHA256 02ef09439bcc40452839212e14e664d69e3ea8d1e4fbd70d00599854e1decb26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 56.1MB
        • SHA256 5a40a84f9267e8cce5534872287ceda6186c722b3655cce4e9f2578cf69ae0ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 55.3MB
        • SHA256 7b2d549ad8a5a8fe77e1c33519e1653a74de67fc6df6b948befb79648b5d575a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 52.8MB
        • SHA256 0721ba791ca19715c92acb96a5f3a2389ab1e0d8dfcb5e7565b1d24b88283158
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 51.9MB
        • SHA256 85f855864ea63fc86d5c24542ef2524c8720b82c16333c249f6f3f210f85c387
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 53.1MB
        • SHA256 0b220018dce736fb4c83ee8c018e8e784320fb1897e4479b1eb9c87b3f5af636
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 49.1MB
        • SHA256 fd0272905fb2dff90b9c5d9ea3f933e8ad4ddfc5ac0c05c5203e3292e91fde20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 46.9MB
        • SHA256 8e6f0443fc789ce9fddb0847fbfc79fc43e0e0ee4b2308ed6cbbc8b274f5841d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 47.8MB
        • SHA256 477b27bcc0b50eb06bdfcfacc5fdb94d48e81fcab3f4a69ec86ec29259b1eb87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 48.1MB
        • SHA256 28360bbc27a0971cb4dc743243f5ccb73f30edf49126ecfbd8a4bd4f5bb7f171
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 45.8MB
        • SHA256 8c537457e40cbe6abdcb06ae3b398e2e16449be7ff1478387adcfd0986c5e8ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 45.0MB
        • SHA256 36e389c44ba695ad675fb2e02020180122b82147f0eabe469e794035b4f8a15d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.9MB
        • SHA256 8a5b66d5e697b3d97c0718568d0ea7c28836fce15dcc561013bb4e18d7f56918
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.9MB
        • SHA256 57e3478f8b4bd3a6b78e013907dbc63cd999337ee1305a83d610356f94ec01ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 64KB
        • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 78.0MB
        • SHA256 f0cfab60a93533a8d083b5298232879dccb137325607ef27d9d6cfc0d949e95a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 77.9MB
        • SHA256 bbb6bbe705048253a0a37ef15d7ce5451064b9c2d78004548e12f487e5fca7de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 78.0MB
        • SHA256 24e3fa309fee3b4b219287f61d221d6bd7bc984e04e272ce53df6109212e3520
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 77.9MB
        • SHA256 95cf469f7c924f25fabc2530ab86f597f1d0ff0534876305dc0a10d02efcc994
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download