Overview

overview

8

Static

static

3

2026-08-10...wk.exe

windows10-2004-x64

8

2026-08-10...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 22:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_70b66e59964d3d38df688da37f7f851b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 19.9MB
  • Sample260810-19tfbavwat
  • SHA256 4ebf102b3d819a940c93fcaefe696875c4ec9aac4f98578d962a0cf3b1effbfc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_70b66e59964d3d38df688da37f7f851b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_70b66e59964d3d38df688da37f7f851b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4880
  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_70b66e59964d3d38df688da37f7f851b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-10_70b66e59964d3d38df688da37f7f851b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3784

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 20.2MB
        • SHA256 165141d8108ecf3757455327386eb2e253437bee699b7e1d352b517a6d5ebf94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 39.9MB
        • SHA256 303cfefbb1b484831dc7b09f6c73acb4d572d9f2d162fc0a7423ae605fb16245
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 44.0MB
        • SHA256 6f5e281b451797c8ba600c7e3d8dfe59061d43dcb8a1e92ed7ac9889b2536dd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 40.2MB
        • SHA256 e9cac054b89fb51d9b7263774339d48f123e8bec4ebc8edb5e1d72a86b497150
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 63.4MB
        • SHA256 355fbcd9a2669bfdebc92fb648e06a60f5515de6b42b803597563f5899a62f7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 22.1MB
        • SHA256 a735dee3523669812e4096ab1022d9c8926e334e1801b2cc968f9744ccd301d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FindGet.asp
        • Path C:\Program Files\FindGet.asp
        • Size 40.4MB
        • SHA256 7ab5735838e87213f9db0f279179b315a421478a53fa9a7478ff6b416ead5e7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 46.0MB
        • SHA256 a91af2b3d828402080316c79d9e3ce0c79849b1a510664c071566292eaca44ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 41.6MB
        • SHA256 eb300d196ae7c3ef09a8bec619838a458072980b9d444d74451161dab3951c65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 192KB
        • SHA256 cc71df767f30aa32b4d730d3c0244896e3d45eb216f18568c46371d93640cac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 43.0MB
        • SHA256 a5ca004102f218398ef5b03338d482fc649f98fbb5c8d3a42e0a3f47acd096a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 41.3MB
        • SHA256 0976bf1b32ef5e446b2c736b3cde036e5e207ab7c946108446914710e61d11b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 39.9MB
        • SHA256 27d10e1f6280d6593fefba30846296b4bc1987fd3e54432b90c26d273493df9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 39.9MB
        • SHA256 73e820cf2d94fdd06cab42c525c24e615c09926b40beb15c951abc439d483d65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 39.9MB
        • SHA256 b66f52f4119d93e77ef4a6f3d14d5c71d8dce46757c9105833897310ddb2e32f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 20.0MB
        • SHA256 e086675f31cb3b646dd338b8f97392750acefdd255f9422bf855dd7286ae7c47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 39.9MB
        • SHA256 fb64eb1329faa5b968986e77c4d75eedd0383ad86f13457a7cf385a28da70065
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 39.9MB
        • SHA256 0693b08fd5ae89f09f8abf5105349cc84013d3823c3202ad5937ad9b74d49f1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 40.2MB
        • SHA256 9659b9d727f6b3989286482a047c27a0ddb503dd8666e20b8d21c757c4eb8c2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 39.9MB
        • SHA256 72c3ce1bd29e3d32bd203b7ec93139512731b531ff73c814c3f83a56f6b102b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 39.9MB
        • SHA256 4cfb430fcc0c2e52373632daecb9987b6a6f7e63cd9bd7883d11010cf2caf887
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 40.1MB
        • SHA256 e8d8cac8487acf78b7be8d750c8af6a0176adf8af95eff39939b532438b680a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 39.9MB
        • SHA256 976d380321fea935c738761f0b64ca7d660f7806a74af7c43d773cca48d53a68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 39.9MB
        • SHA256 36cb11e22bd7d1e5ab709cfd3dc46506f76f5aa091bdee0e0be00c3c611cd0f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 40.2MB
        • SHA256 b0451dd76dbc856cf569494529a0ec6ecc26b0e799078048ebc4ec9a4c5b2fcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 39.9MB
        • SHA256 efcf9c6a9b51271b57fa726f27d3404bb2c66aba91fc3f4c477684974ad99317
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 39.9MB
        • SHA256 03c656e1e6cb71430138552dbe44a2c04afdee1eb57f27fc4b76e38a484c57d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 39.9MB
        • SHA256 7761fcae5c6483b7f6ba79b30ce44df1017b60779f2296c1ae94d283b65d4622
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 39.9MB
        • SHA256 c697c3c7a662c6dac2ad328ebe2e7af206b35bcee4ccdc3e9206a5ee1f20e64e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 39.9MB
        • SHA256 9947570ddda08b5513720871b44a29bfb0ba25d692e0401eb7303deab2f91a6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 39.9MB
        • SHA256 1cdac8096e5783589ebce65f658d698b025a1204842b6296a13008755f76bc09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 39.9MB
        • SHA256 a6826567a93973eec998ed995c1439b54c0f8e50cb8454238ddd6111f611aee3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 39.9MB
        • SHA256 a10a39c414071633ac942c8a5b846e850e3b7989dc1b2b8b6a69c4221fcc25b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 39.9MB
        • SHA256 4779a4d73e1264d5e1700b343a02a1086f327ba6ea6bc2fa3b8bda34ccece18f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 39.9MB
        • SHA256 f17bd4360a4e9c733463860e7571be3c4f188dcd2d21e220ac0e32847216c288
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 39.9MB
        • SHA256 37e2466efc5dc5a1a13b220c5ad290b686b21d1f65570a3ef81cb08e6b378271
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 39.9MB
        • SHA256 453c10246367e6d575b05c433778385a0894dd1ff8895b1321570762ba5e11d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 39.9MB
        • SHA256 8a224deadfac7644f0eff36dec3542af9bdb654ba89bd1fc090d8c0737cd11fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 39.9MB
        • SHA256 61ea571052524f17e301aa4f679dce9cf94cf93becf492bbbec2e77ebc51333e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 39.9MB
        • SHA256 777ea7ee0f1f48211835344daa296ca949e5eace04547d1dabc7784931bbff6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 39.9MB
        • SHA256 cec7af004900de21f391918386b0da2f50e61821ca78ddc9231ba0ccc2b73ac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 39.9MB
        • SHA256 c8333d53e48c950f9ed3b09db42cd5f0c0130aeaa03fb29bba0c53636dd0c126
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 39.9MB
        • SHA256 cb5aed4493f06141eba0edd7f7b3a496ac16b7c7c3eed0acadcfa57271d60e29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 39.9MB
        • SHA256 55a576fe026c78adcf992d982927be1f690ff38835b672975ad8b6622318b64b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 39.9MB
        • SHA256 17211cac600e670ef9e347fe6f21a1ff2ab4fcca4f150f35432e6ec52e20688c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 39.9MB
        • SHA256 c71c6cdcac7b2078e1537a45be1f2806b0712b600ab3072025b6ad4b6bb729c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 39.9MB
        • SHA256 e37779783a6206111256be4dcbcfab3071f98d69f128da10aff2dfb526455d24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 39.9MB
        • SHA256 847f03c3f5aad24f64f0f938edb3688f24c116b06a3a98a08388af2e3e98297b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 39.9MB
        • SHA256 9a2e3195342dce79906eaef0a6d7d6e60e803719ccb1e937db80f5f33db3d58d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 39.9MB
        • SHA256 f6306d4377a5c6943662441e2716e65dd6ace8ac6718cc230257c2dff2c44f51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 40.0MB
        • SHA256 2a3c075b18ed631b2a6dadf7cffcf3d3af025d088179b6ba9466b5796d2e656b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3784-29-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4880-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4880-13-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download