Overview

overview

8

Static

static

3

2026-08-14...wk.exe

windows10-2004-x64

8

2026-08-14...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    122s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/08/2026, 00:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-14_2e42036a4bcee4be6c3218c99e660e28_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 43.5MB
  • Sample260815-afc85avyfv
  • SHA256 88bc6aa156ec5f5acf5791f4382212d4a9d927ed5b41c00dc77c0e97849fdbe7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_2e42036a4bcee4be6c3218c99e660e28_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_2e42036a4bcee4be6c3218c99e660e28_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5212
  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_2e42036a4bcee4be6c3218c99e660e28_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-14_2e42036a4bcee4be6c3218c99e660e28_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5316

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 43.7MB
        • SHA256 3f6a970a36761a91f44c1110f85c8911a607d03ed477f205334c045418e29d88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 43.5MB
        • SHA256 077806a754d8e4c625aee2901794ac3cfc199686c2b1f57edf40e92305630753
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 44.4MB
        • SHA256 7a63e409ef78e2f8db4edddcdd7bb012a4ed6e751acc3b61f345147a8dd12c3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 44.1MB
        • SHA256 ec7670986d6731f93ee3771926d61e0c5353832969021fe4fd7c83b5a36eb892
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 45.6MB
        • SHA256 2ed0349f483c21b1e678ccb02ba27e85a191fa7a37456b9124bc52ccbfc46394
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 42.2MB
        • SHA256 267b66fdd91a6af65724200a1255115f8bec961dd2b997f5df50642aff3c4f74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 30.1MB
        • SHA256 ebcc1b429138463ff425c491ad618a9701261506b1869e3a23af2ce63f586d22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 28.2MB
        • SHA256 6b541e5909ee2cc8689913796dcd0cd0f7f70cbbce5ed7defeb61d1bbb5607c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 33.1MB
        • SHA256 9e924e11238fb89f47c8eb820282450806e1a41d3941f8cafd7f45b63c260d02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 33.2MB
        • SHA256 9570c31e236f0f9de1fcb6fb486c3feb759f49a2f1af5572dac5927d8829ebba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 30.5MB
        • SHA256 5425388921d31093f7922c859d54f2863aac743b11cfc39cca100879af48b00c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 26.8MB
        • SHA256 5dfea39f4b698330f6c5f77719d633f84190ee61b785004330b4e6f8866d0d6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 26.1MB
        • SHA256 52c285c1663b53e8390790f86db949755d06632ab8767c6d6cbb919c50ab8e57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.7MB
        • SHA256 2a332fa551e096c8754b190024d9a36ea0167f53ff323393f869170df61bbc60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 27.8MB
        • SHA256 739154c9874b7050163bb815b5939a92f6d2baa7f889f67f2e5084269a99088f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 17.5MB
        • SHA256 ef42e4ae18dde21e2af294b037f2605d2c5c51f0a7df03c0db462b88e389990d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 29.1MB
        • SHA256 dacfa0c309ae174235a11311f825c3a3396182858ec7fa65ba61c67aefe75025
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 27.7MB
        • SHA256 d7113b78627379c91f1f10fe7b7206cf5df8c88c1edfef87d05c20391d8001e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 28.1MB
        • SHA256 42f9cdde7b279db77fe57a4f7e07983683d050e0ef41970ef7bd2f7acf0da1de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 26.6MB
        • SHA256 a23449678185b0f4a2fe546f485e816107e3a682f6ca129b6a9cd3002a82ffbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 26.4MB
        • SHA256 bc6f1cf31b564bef2ebc5dbb5e352b9a2564bea430e0654f5b4f51cf7b94cb15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 25.8MB
        • SHA256 af75d28556d3ba8f4b33c105ea8be3adc7bf3ab3765d0e1acb4c341a1e90d3fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 25.1MB
        • SHA256 be4254d8a9713a5ea923f3878250e1efb4a7e0a9691c3c06cdb9dfd7761fa06b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 24.2MB
        • SHA256 0b38c5d6140e61aa750463fdbec0f6e8d78661a877f8f4b297aadb435c2150bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 25.9MB
        • SHA256 caf6452918311b6ece6417c48ba7f09c784b095a89d9585aba603b07c9a0e013
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.8MB
        • SHA256 b63e937e3dedb8e8ae6d3cda4f2e2a9c27c41230fddef6fc22b474366f8be063
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 23.8MB
        • SHA256 f37fc3fd9e7561955a80ab2ebe90b8a9d0b12f79e788647e10f4fa1b80c0535d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 23.2MB
        • SHA256 3b6cc793dbea2acc4fed9fd0f1a0fb63e3d2de61cb769a5582f42b3dc96d0a56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 24.7MB
        • SHA256 12e920261076d8c041bfd20e3cbce86c450c868cf2d86ab8868ab097538248df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 23.6MB
        • SHA256 e727239fdc01ea9cd8faf7f2ba00a2bc9d01806800d09425c4437a9bdc0591a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 25.4MB
        • SHA256 2ebf58657e8e0e23f661918bdec017f122fcefa33d2cd0bab12855d40c8559a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 22.9MB
        • SHA256 e8d9671c90d99e15eb889628bae6c6abadafc0b7efea6f2f05ab6449856c0875
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 24.1MB
        • SHA256 f5cbbd5f57284d914a27d4b8497edba1febea1aac9707a41cf8dc3aca1f39b84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 21.9MB
        • SHA256 bd1675436ae6c0b2830d3d9fbd8bf7eb025a85b17b2c834b1644c5a67dfe878c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 22.8MB
        • SHA256 afc8748e38a0726d4b3ccc713e335c8c4b8b630b852a45b222186eb6f5aeda05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 21.9MB
        • SHA256 72d1091558b0704115f1b69ad134cc6bfe4b518de55028aa25dfaadd442e368b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.5MB
        • SHA256 656db3b691f854696cd1dd57018ea09144325c444fe8f6464699c3c47fa16d28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 23.7MB
        • SHA256 cc9b3b0c95beb769e84d59b56a646ea564a8e0bf00bcdc0068da9a397f36ae65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 21.8MB
        • SHA256 458705361d6e7b07c074da97c995cae2fc07295a372f7f7a9df5e84f6d18d9b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 21.4MB
        • SHA256 0283ed35d22b28d036a0ae41cd4851fa694738fd20c4956d8bddd6639d7907fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.6MB
        • SHA256 ede4e5b276987cdf4bd8b8f13a65386d12c43eb04c8f3cc158ee8e8683218505
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 18.9MB
        • SHA256 52a946af46f14cd5270e6648c444a5cf0262209d36a3ca8841b87d643b1a1d9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 20.4MB
        • SHA256 35d7de572630d7c434db6f23f670569f71336c2fc11b6fb5cef42f1e3d16cc71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 21.2MB
        • SHA256 a69386497af2249cf3b063c5ad5f3e63348ff7c40f71dca02c93e68c6ac92c2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 19.8MB
        • SHA256 92067f3a18fcae9318b6e459b4e709f8dab1e1d7e6e6c8025c1927806662bbb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 20.2MB
        • SHA256 4e5f42e71d08f43eb1361e28b2b2543f39a209b7641589088ab92a120e646717
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 20.3MB
        • SHA256 3da473dfdb49299e27805d3d9708b17b7d2862eaacae0b48dce0b84e6c436bba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 19.4MB
        • SHA256 1614056321538c5068555e22e94008e17819ef754aa3e6c0a22c2dcdf4f0afda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 20.5MB
        • SHA256 8aac264fc71b583cf6a046a9edf39e5984f47e1cc94a461c2a3ceb3cf6802a09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 19.0MB
        • SHA256 c7e1aa44265bfa51ef43a5ed5990c9c511d99a243dd7f33ef3b5cf0a93598883
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 20.4MB
        • SHA256 9fdf6cfb4ca3a6a52f9efa356dd476d6f7bd4e2dbd6e39b58fad32c022693118
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 20.1MB
        • SHA256 81fd4b848429f72d52ddc0d32f8ff3f0c62cf56ca380ef99afda6c458fc19467
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 18.8MB
        • SHA256 262a577bf4b279008a4d60f75f51bf2fe7e3c58d95d81c1b350a33948eb33979
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 20.0MB
        • SHA256 ff46656f56b6dd730379e39d248c2277aa840d29302aec867630221f511f0da4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 19.1MB
        • SHA256 b768d00c92044ecf7b429955d761ed6e37a545cba977a6e6a5ae208d042131a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 18.4MB
        • SHA256 39c1147f99c6a63aa4ef457172ff9c1dbd9e95f8a95d0c2b4accfaad2395d3a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 17.6MB
        • SHA256 66e10c43752d81451861425498f2562e385558b9f141b508c1edaef565f51b04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 41.5MB
        • SHA256 752bdbe3435324c183e2f66bab72acef36d5d9c6e503ac61e8b0d1e06af02627
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 37.8MB
        • SHA256 eb5804875951512071c1e2fa160c1cec1f924ab2a6a370a1d31b927d6c7c63da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 41.1MB
        • SHA256 0a6490e8aeed710bf092678f6ca09da688b3ddda1408d8ad51558fed849f4e2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 32.8MB
        • SHA256 2f8e7c46c71b27c2f5679424efbc220fedfb61e11b7e6b5aa14786772f86f1ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download