Overview

overview

8

Static

static

3

2026-08-14...wk.exe

windows10-2004-x64

8

2026-08-14...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/08/2026, 02:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-14_0385284f8d49febdada986b6bef16289_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 8.7MB
  • Sample260815-c6dnpax1ex
  • SHA256 fec6dff04432cd7a2dd8e276202cb37289ea09905e91bc84bd2a1394bb196612
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_0385284f8d49febdada986b6bef16289_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_0385284f8d49febdada986b6bef16289_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2736
  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_0385284f8d49febdada986b6bef16289_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-14_0385284f8d49febdada986b6bef16289_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4476

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 8.9MB
        • SHA256 00d71cb161c026bf47408d6abf8fe5888aebfca0012df8566ad0c9327b962433
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 17.4MB
        • SHA256 a0cad22c01381021321f86b074feeac8146cecb859867194101a94ace1267ef8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 21.4MB
        • SHA256 518b3f164047e1a2165f37e56f5403d8e0e86faf973168d94eee825125be122d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 17.7MB
        • SHA256 939c2e062870f42153805fb518232f5c7a9bcead3ae26717a1091c777cae3d6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 40.8MB
        • SHA256 da8f0da4fc189a54a14af87e179731f16f3511f79051538f2402bf8db91c51d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 10.8MB
        • SHA256 f45bb4a6d436f47bf456f205906b55b4a0ec12c37ea2c6183f244cfe0f4d47df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 17.4MB
        • SHA256 e9a758bbf5962fb8e44feea3d58282125091898f152118eaf95f8a8b8cfcd041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 23.4MB
        • SHA256 bb29c1f392a4fafcf78256835a65d792888e519d2052700da4fc69d7be603cc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 19.0MB
        • SHA256 0de7c7334cfe293b1dcb151860737e3bd65780d12d8758244e31266fe330e8d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 20.8MB
        • SHA256 636d72ec2d2bc135fdf2c922f83f04394c28338aeb487e9e8b4cffbcd42bf741
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 19.6MB
        • SHA256 be7d7037079426939a52b1768b44bc19c0cb3e4465aedbcbbad619c0f16aedf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 18.9MB
        • SHA256 9b53cc6efcd8cc176c5f5dbe4aef85e48b719d815d368eea18c94cf8cc07c556
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 19.2MB
        • SHA256 3fb81f724e468c045f1440329c04c1db92ead7aa00085db422b82fd95e9aafcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 20.4MB
        • SHA256 363264339d6ac04f49528539e9fb68e1aac484c55ef644f11b80309fdeeeae73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 18.7MB
        • SHA256 aea112f573cb0a87f230ba7250f21b54f6c975485546935b2f20f01ff3756ce2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InitializeAssert.exe
        • Path C:\Program Files\InitializeAssert.exe
        • Size 17.5MB
        • SHA256 6db6392c02e994884ed4631a576d4d0d940b44cbf9115559142acfe74367f879
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 17.3MB
        • SHA256 8694c8e6d844c486550a99b6b0f98e248d84a39ed120ce6c255a70d9677e41dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 17.3MB
        • SHA256 41a400b7d6b18febfb29ed5ef72ec8a67733a2236f64f8a1861f40b682c000ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 17.3MB
        • SHA256 0b05806e775bc9bb0349c0d9a3d55532785f887316e308ab7801e62814e675ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 17.4MB
        • SHA256 52b6ef7e1994a36cbd7dc8f3d5351b0ba7fff88d855fe6597f5411a12739c0ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 17.3MB
        • SHA256 4f59b5e9b6b9b8647134057c354a0cbbef0139390fd50b69ea6c23836a97cc77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 17.3MB
        • SHA256 43a77c5a9e5bd00de6f1c620090748ec1a3cdf601e799a3c8c20926de189fdb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 17.3MB
        • SHA256 549e1bdafae4259857a51b84f45d5f3a57d190b06285fba96fdfb04df3e8677f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 17.6MB
        • SHA256 f01bad1730a2eaab154d519a67d9bad4c911d11fe39493efef70c6fed0bbb593
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 17.3MB
        • SHA256 8d3aaeeebff9c77ceed2c4a3ec07d1ecf43dc0c8fc354feed71edc027ed28b62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 17.5MB
        • SHA256 424bb5f6fb2d1f1c4406d2bc81370a56ff7e585f957bcc9523a35fb888af7d3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 17.3MB
        • SHA256 3814657785ef6afca17df9324fe5bd97585eca4cd79496b6b23973ddcabd4388
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 17.5MB
        • SHA256 9031c13e4e96aa7e04b979ed0ae18ddc5b624a8458522983c78d0d57ff74896e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 17.8MB
        • SHA256 342f88970533c7e9ba5c42147e3db910869a6cb991a69eecc8f183117707188f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 17.3MB
        • SHA256 7b806a8d986f9cf2bf9cad88f8cdb1581325927e08d5c507c15737d36e72a758
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 17.3MB
        • SHA256 923b5b8aa7b1fd31e2b6c2b323716ce936f3e1c11e6117aa33871bb4d3c2742d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 17.3MB
        • SHA256 def458f19c52a14bebb8c2689fc704c5805e95ab7f6112bb10f48a91eb935a18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 17.3MB
        • SHA256 85656fb0770cdbb962c0aeecf747e13c2c79361dc308d73b5c670f2d4c38f283
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 17.3MB
        • SHA256 2d750b2ba9d0cb2804ce39e57a28b85b482cc4d93b70780f25d85e522bfc7edf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 17.3MB
        • SHA256 1a067df61981f8ef4e0988968362041b8bb4af4fcb5ac94265a6e3f6c8a544e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 17.3MB
        • SHA256 98098bb520682b93432503abddeab2b10e218c839d0a1f1ceae7d9471f3cbc65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 17.3MB
        • SHA256 21486b1b209a49008e6291423c023700f1a78b20a90615f5f77795f2dd634ba7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 17.3MB
        • SHA256 fb24ed34f5374956384dda7b3cbfaed1cf079552d868f01a88444c3ca0ee4442
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 17.3MB
        • SHA256 ee224f332ca6ee57887e43d7978c6e609f877f5ea0d16bbaaad1f4b22212d2dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 17.3MB
        • SHA256 e6f1c9ddfa3313a596a58ab87352eb2c7470433e8cbaf180fce933fee0f55daa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 17.3MB
        • SHA256 914458ab2dbe64a68798cce46ee5a91a53170e606057f0b0ee1b12bb964c7845
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 17.3MB
        • SHA256 2eb9a336770e4b5027d63ef2b32a39aa90ee19b5bdb4307afc7f4f16872fefeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 17.3MB
        • SHA256 f195c43f13b6a223884a1dc48aae2fc902f50aeee7e854ae80c450b07a5bc354
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 17.3MB
        • SHA256 bb6ce8b5d3034d4a8a5d921716c433013286d8e8c95b9b29e2bd622240390905
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 17.3MB
        • SHA256 de8a72361fcbf7582bd68c040d1f8b5743353fcf1cc6bd4f7222375ecfec0513
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 17.3MB
        • SHA256 e522b50ac515a3cf6aeaea3e720c1d2c583f2cb89471364a477f0eadafdada41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 17.3MB
        • SHA256 985d80a4f82b343d664e1b1902bf377c057c289731b597dddd51e9838f810036
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 17.3MB
        • SHA256 9e243173cb6e0cfb7db3b49c6a9dbf43ee1bd7493cc4668c5f27192bb2ab247a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 17.3MB
        • SHA256 6fc28340244362519c69413d027e8c7057dad4ce1c8a8fe1eede8baf22ff86ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 17.3MB
        • SHA256 b89c2097559e1668bb2f76004b45395f7547202d455ba8a0e33a40e79fbb43a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 17.3MB
        • SHA256 0bc992cc17f5780f049c2321bf2de5b0432265c73f924e5ceeae415890e17a19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 17.3MB
        • SHA256 6c24193f624b789f23e28381d32cd78dc218c9808445fad0fd0d27746093dbcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 17.3MB
        • SHA256 6fa9675969f9394fb2d8ccf06fa824464aa4f3307c7cbe152b54ae5ad61f7ceb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 17.3MB
        • SHA256 3f0e67b07e78dcc09e90f0347a8bd6c32c9ff9eb9dbe10c47a1302a14d8fe9e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 17.5MB
        • SHA256 97ca6e17cef3a373c03ae4a3f9cc152e576d82a122a2ce088c5918aa97d3536f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 17.4MB
        • SHA256 e039096654c499c543a9806d510504d7e6b875f3a82f2518dbd1e5f013a607b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 17.4MB
        • SHA256 3fb18bf09f0b3ab5866d127cd5593e6af4efe79e463f07344c21f379d6a90bca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 17.4MB
        • SHA256 499ed0a66f6e4bac29ddc4bf9879994cbb1f6e41d0fce0568b90de1033bcfbce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2736-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2736-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4476-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download