Overview

overview

8

Static

static

3

2026-08-14...wk.exe

windows10-2004-x64

8

2026-08-14...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    105s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/08/2026, 00:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-14_2e42036a4bcee4be6c3218c99e660e28_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 43.5MB
  • Sample260815-afc85avyfv
  • SHA256 88bc6aa156ec5f5acf5791f4382212d4a9d927ed5b41c00dc77c0e97849fdbe7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_2e42036a4bcee4be6c3218c99e660e28_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_2e42036a4bcee4be6c3218c99e660e28_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4928
  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_2e42036a4bcee4be6c3218c99e660e28_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-14_2e42036a4bcee4be6c3218c99e660e28_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4324

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 44.4MB
        • SHA256 dacdbf9556e94772a50994c405449276067034e91c9dbccd6fa6966f156c87ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 43.5MB
        • SHA256 8e85b3049eec7c7ab23de73648f1214316fe0425b79288cabef85c033c1075b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 51.1MB
        • SHA256 52aa9152b00b1b9655175423157290c3fa3aca4ba1e725ee86ba70a8848f9681
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 50.0MB
        • SHA256 d560dd00dec95f997618a8340d6bcc29734f9f465c12cf67a664c966bd76c573
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 51.9MB
        • SHA256 e1b14dd9cac087bd6aba0fb7f39719aebad4d8a5880af0c4da52185912c6ca24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 47.4MB
        • SHA256 2f46aaebbf6e2d2dbfebac9a0248594166a50058512e1da47563cb54e5908fa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 32.4MB
        • SHA256 5e02bb3c23a0f2189cc46e09809c760f28db9316a95ccf5364ff48d2c1239494
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 25.8MB
        • SHA256 af75d28556d3ba8f4b33c105ea8be3adc7bf3ab3765d0e1acb4c341a1e90d3fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 27.4MB
        • SHA256 0d0205f95a72b73c62a6cbe8bb169812e71b66a39352e40235bb5fe19e59e071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 31.2MB
        • SHA256 eaddcba21dcd489b95626f67de8e72a6f3b4ba29e44c02282cbf484f8e8876b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 28.4MB
        • SHA256 b7956911de2cf1343c48425bcc684a7bd34f4743b1598f622546b1bdb0962f30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 28.1MB
        • SHA256 42f9cdde7b279db77fe57a4f7e07983683d050e0ef41970ef7bd2f7acf0da1de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 27.9MB
        • SHA256 beead4bf7c676950c2e1922bfbb15d36dad5b8277eb38d6b0aa78091b46857bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 26.6MB
        • SHA256 02787e0893f0363180dbed9221d5f552adfef20b8f21d19832972366435c984a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 24.4MB
        • SHA256 cadc3f2c11b9a28ba2c529dad0d3f3c523b4e52eeca467986de5b85bf38edd36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 25.0MB
        • SHA256 ffa8d92837d9402c97aca092a73d209c48746f5ea924bbea0aee1be6f95c272f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 27.0MB
        • SHA256 2d036c90ca513125bb2ec34e43ebea8e0dea404cf85c04e071e1afeb0492d92e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 24.1MB
        • SHA256 4fd0241af70e159511325e064fca886a675dab76c60187f485378f24262b7da5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 25.4MB
        • SHA256 91f78f865777adc270fb08cb6f37f1d4c42b697259423c98c76652455c1fe028
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 26.3MB
        • SHA256 618b9517c050432704f44f088ee663ea2855b71bc17e09fef371420c5750aeb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 22.9MB
        • SHA256 c9993ae0a1be7c33f1958713c40fc024bfaffe8e9516da6079f4c202a97e0a71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 23.9MB
        • SHA256 a00bc2a1970d75ecacc20b9ccd1ee4522e77bbf53920260d02c9c500ea3e2c21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 24.8MB
        • SHA256 34ebc1896e1d8c8f939e9bf85be5df1d8bf85624784d9ae26cd54e693088c5d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 22.6MB
        • SHA256 ede4e5b276987cdf4bd8b8f13a65386d12c43eb04c8f3cc158ee8e8683218505
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 23.4MB
        • SHA256 0bb140643ba4000467e2a3e86d4a082107238834a6d5f7735eadd5e5683d3b52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.2MB
        • SHA256 1c01f371644a892886c08ba849b7c2d2feeb1588db19fba0396d61261b5beb42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 20.8MB
        • SHA256 60f4371d2293ffd8b8050bdc41f651d8f3d73c665187ef74ace76d4e7a99a6c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 22.4MB
        • SHA256 9755306103ec0b5f3e1a6b63cdabaa8ebc979a78a1385accdc944b319f7bac04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 24.4MB
        • SHA256 b93b7f097ef92b68854f4d59fa5c0d071a539e97d036265341efc8c2971fa576
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 25.4MB
        • SHA256 2ebf58657e8e0e23f661918bdec017f122fcefa33d2cd0bab12855d40c8559a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 20.9MB
        • SHA256 9d2955dbbe358e968f34a274da62a6548a1666737139559a0b5b954c056e9acd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 23.3MB
        • SHA256 a89b55fbdfc06782f217b2b7dc8ed0be6acd8ede474d816f81c72fdb52512866
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 21.7MB
        • SHA256 af0e5ec8e906ef168f218258efca9a59dec7fa068eee11c9c221f936668cf03e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 21.0MB
        • SHA256 509cf7ecc0236d1b35162aaace4fcd9c36a1ea5ec054d2ed288f8f7e8a14759c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 21.1MB
        • SHA256 6ca42d61fb4f7e5a1be4e3b893745612fa5feeec9980cb52221ef1a7c8bc7af3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 21.6MB
        • SHA256 6a1ae0e2720df02b14fea6174258b12624f8a4f5cd7e2fe5c5c8559c6027c711
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 21.1MB
        • SHA256 406d59f59830ea07c8caaa3b3283826d07db7653923d4181e33409d65548f6ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 21.8MB
        • SHA256 458705361d6e7b07c074da97c995cae2fc07295a372f7f7a9df5e84f6d18d9b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.7MB
        • SHA256 665d6b6988086aa466e8af3a07f8cf579ed156aa62c1356647032ab93c33b0c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 20.6MB
        • SHA256 c4277ce8cbf68d4bab0be2135f281a2e603dd25061ab03137874b7fa1f2d0355
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 23.1MB
        • SHA256 8f2cb64d3b04ede5e4b7c0f35cd8123dea5daa673653875f419b93198ed2f661
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 18.7MB
        • SHA256 fe74ae0ab684b8b9d8b4f6ddc186e2629de3480762b1508c40484cabe921a633
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 21.2MB
        • SHA256 22aec564f450a53df5b3aa0861563fc35ca357e60f73d18e90537943b15d8c1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 18.8MB
        • SHA256 e904eb24fd40af912f820a889e946ce56f67b191bc7589b6307bdbe2d951d7b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 19.2MB
        • SHA256 e8bf70b0272b436f0eb8fb1b1d18d73a284496c66299a47f334df6606fbf9856
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 20.2MB
        • SHA256 4e5f42e71d08f43eb1361e28b2b2543f39a209b7641589088ab92a120e646717
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 35.8MB
        • SHA256 ca74f1dfed0c03ac156e98457ceb83e7388e8ac881809e6e6d206be5b2e0ae31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 39.2MB
        • SHA256 5ef392c30c8b45fcc894aebe698def4e8e6140be2bfa5b694d100e2cec4f12f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 31.2MB
        • SHA256 d2fadc20df238b094d25f3d357378fb93f5ef40d517550e439540864ad41ba7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 28.7MB
        • SHA256 9bf921a6b5c62b93ea1eb64214d0144ce990db40457b8631b9b7cc65f8c87345
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 43.5MB
        • SHA256 88bc6aa156ec5f5acf5791f4382212d4a9d927ed5b41c00dc77c0e97849fdbe7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download