Overview

overview

8

Static

static

3

2026-08-16...wk.exe

windows10-2004-x64

8

2026-08-16...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 04:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_3cb00802a48826b2c52d8c123279ff18_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 12.6MB
  • Sample260816-fd62ba1sct
  • SHA256 7c30003bf78b0fbb9fbf2373d74e46bb8baadff0d5e24690de624f96a07ff69e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_3cb00802a48826b2c52d8c123279ff18_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_3cb00802a48826b2c52d8c123279ff18_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2540
  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_3cb00802a48826b2c52d8c123279ff18_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-16_3cb00802a48826b2c52d8c123279ff18_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:916

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 25.7MB
        • SHA256 644cb2ea25138dc258430fbee42cb3d47caf4602ddf6b94723c1d6145afb9fc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 26.1MB
        • SHA256 572f04ec266ee75071ba8c82cc77a9c8a24a49f3fa74eedde8bbfd7cd68b677d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 13.3MB
        • SHA256 0c3121be35c53d8521ac442a457a043f864a23bd3296f5460eddd6350e46068b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 25.2MB
        • SHA256 85b7758bf01bcfe7a4eb7bb60d05b0e7877a10a3523917156ce3604d5a98c804
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 25.5MB
        • SHA256 510a067c210dc5d2da3dbc94252b7c3e37f4300a89fa513f6a7b02b982d7b9c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 25.2MB
        • SHA256 2e0acc527fa0d8c7ec3383e8183d746c47e594fdaf311e03ad87a81ba6130b1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 29.3MB
        • SHA256 752c2cd208ffaafd1d8e81cca874fcb0c776cbf5d0f6be7b93b2c1241227dff2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 25.5MB
        • SHA256 15f6e633a508564695c53bdcfbf1e9b4976df961d9cf4633dd8741cf8372998c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 48.7MB
        • SHA256 4555e998d1b8e1fe59b1fdb60b15c8a82a40d1d78bdc337162000b12d1bdb539
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 27.3MB
        • SHA256 07ac305861c1b1c9783472191f9e7db1645bc157892696e8a8a1c2ab4f824077
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 14.7MB
        • SHA256 6c2e36a6d0b6da21598472f380fc82157442d03c7cc0b9012f49869377a0f286
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 31.2MB
        • SHA256 201f88293f70551421b65cc7a75bf620476761324a7c18a191955e60051407c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 28.6MB
        • SHA256 943004b7f183496973923180a17e3e29eadb32c07d7e931b4db8bc45dd00b290
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 27.5MB
        • SHA256 0aac26d35957741e348c8f6ccbbc28228e6101851b18999c33d090b07551da8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 26.8MB
        • SHA256 7c6209d2f4f178bec660a33f5c373432654a8b0951e0ca271a9124f5c3654151
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 27.0MB
        • SHA256 affa5150ddbad082f7ecc9aa29ec145c91328dc5fd554a0dbbc8999d8b6fb689
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 28.3MB
        • SHA256 773e9f78cb6b3f95ca45ae10c3bfcf821381a2c8a3967db247237ef23d21d314
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 26.6MB
        • SHA256 c2717ba1fd7dc2551e778804677d948fed406003c1fffbf64af3c06932e9b511
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 25.2MB
        • SHA256 196aff7e86fa99d770248ecf3f02d71f127c77903cb650da4f1b715668f74890
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 25.2MB
        • SHA256 50970d1fde006f1287540faf930b03a3eced0ca699f5ee582efa9d3af81a9d2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 25.2MB
        • SHA256 8a2a9460eb932f3813b33c360b8a7756f3e0560ee54f8f8c3b8173cb67a79326
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 25.2MB
        • SHA256 c502fa788b44ecd4e1d745e9a766cfbf62cf22b8e7579e520569e0c13b6b1ae4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 25.2MB
        • SHA256 a966e1c5b66a06be597257f64d18970591f4dfa0d43595ff9e65757e5b13fef0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 25.2MB
        • SHA256 3ffd8553987f0542e0e4fd8017cba7c0b489691e85f2f038cb56ed4e8bb6055c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 25.2MB
        • SHA256 751ce058135625d53e5624dc537104a7427fa3995148ef6d2e592f9a8c97fae9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 25.5MB
        • SHA256 2a1381d6b3a9cb3b0fb9068d4c7e6767186172843db685105b71715e53a312b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 25.2MB
        • SHA256 3ac348638cb363618cbd27b17c8c634d2718c90e756061cc5ab4e4b18882c790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 25.2MB
        • SHA256 a76d3ebadf41f47ec14c1cbad10a10ae03283b6de2c755e24b79a3d554a24e47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 25.3MB
        • SHA256 42e8b4bd559b4c66e660ac86f55b7c65d3e01c2361607619a8c71206fe8c1ef2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 25.2MB
        • SHA256 51656358b17b4e8c5b747dc5b376327d0bcbdf4f2a73386a66c245e641b34860
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 25.2MB
        • SHA256 8ac925531b232710b8a3021615dbd2f9a858fd241efb301a6447a5dd6ba944d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 25.5MB
        • SHA256 e507dd79f7464a8e7ddb355bf28fe4cbf5ec34f29243ba210633d66b7d181b2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 25.6MB
        • SHA256 5ac1329ed32304eda051f931a02477da65d1eb71d3a098f8b9a95695873d4a02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 25.2MB
        • SHA256 55427d68b3a6aed3e2b5b8665bd8cff469fae6a736fb24d7649d46e04d3d2571
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 25.2MB
        • SHA256 e898c5c26892b512076a9cca42491df5267a32812cb4fd701ed86aa358f999eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 25.2MB
        • SHA256 b44f6877ac4b85275bd744166327fea3594eda400e8fe29ca1d8908766cffe9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 25.2MB
        • SHA256 3efbc394aa44754dbd390416bc7420d8a7b32f8f2b899ac1fd34ba0ccee849c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 25.2MB
        • SHA256 47d82bf1424e6d1e89050948a2d60f90f24987e6103fb15b4befdda3157ba8e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 25.2MB
        • SHA256 72549ff7acbae5cdf1538308f01ba819c6fcc9c198c913d1cb88bca19812a7d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 25.2MB
        • SHA256 859a26500a1594edcf05f1cefae43f417d8303d694a05a12eca5bd09945cf93d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 25.2MB
        • SHA256 5c3d1ae7b837bd483fdbca78f5699292378276bffd802d15ff9803b3b7d13630
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 25.2MB
        • SHA256 37c6f76dd59633811eef2ee5cbb6fde795b0a8b29defc72e7dc1724822680ad0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 25.2MB
        • SHA256 c74ec0a1851443e4c374cea6bbe9701dd6ba1940b67ad16407151b523c43d666
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 25.2MB
        • SHA256 2d4b895a1b4ad9ac7fe4f882cbcac46965d87d0d53443b22085f2da20053638a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 25.2MB
        • SHA256 fe466e0272d15c40ee70074478a7f6f0ef3212b97d5acb59145f183f80c0494b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 25.2MB
        • SHA256 0c81e140878966ad4971a3cdeb065a06c0f5a608004ac80bfbe94a268f0a2d52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 25.2MB
        • SHA256 68cb8a78168612d19e7a9d0343e7f36842489e678ec58d793ac4f2c164fa57a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 25.2MB
        • SHA256 bdb3903915e11656862a4f8938e0a3c181a7e81586dc37bfc2862e7b3c592f51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 25.2MB
        • SHA256 ef7dcb2645ffc473ea74a8ca661ef3827b72c65e6055be973422e4151d4562e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 25.2MB
        • SHA256 f9430b20c0260eae4874d341f60651b0c0328ee477a2089d078d3c2b96999f4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 25.2MB
        • SHA256 53299cea1f1eeafafb324eb635318e9de8a0d5c8056b83a92d42a8668ad81c74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 25.2MB
        • SHA256 b8dd73d263a6232b135a26e4561e2498240f8ee6eb4c7d985e7041ca75d86e72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 25.2MB
        • SHA256 4485f24a4419a2d5086ae5e090a3fd54d36bf70ba8eff6e7033f5ed23c06ecc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 25.2MB
        • SHA256 dacab4d08a26fea19023939c5e9c51d4952f3b85af9c336411bf268af66f9549
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 25.2MB
        • SHA256 dff072c73c8a2969e42a688752ecb33d6591339b7fd9c801e1a60243bcb5c0b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 25.2MB
        • SHA256 e5df61ffc1a2dc65a0d2f305bc5560f2ddd636526b313fbd924f36658e1be995
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 25.3MB
        • SHA256 e5d5208d9bf4177162c6eae0ffef7dd37e1477860a16fdaf34e1b28c71c0359f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 25.2MB
        • SHA256 9b280f619707502fbe4a4f34dace89b2e4b7fa696fb55e636cb22040ab39945a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 25.3MB
        • SHA256 678a0896979d64113146f30b3a390c4f50a1ee1efedabf16cc54cb68aad891c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 25.2MB
        • SHA256 a151ea78fd78663c8561200bdf0bbd769b39d21200a50166f365fe8f6790395f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/916-33-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2540-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2540-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download