Overview

overview

8

Static

static

3

2026-08-18...wk.exe

windows10-2004-x64

8

2026-08-18...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    70s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/08/2026, 16:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-18_f2767f5e9149189537d1337605e1e977_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 15.4MB
  • Sample260818-tylsrsxtav
  • SHA256 050cfadbfd2d6573afeffc4757571e65dfc69952c7a9716f57cd23602181fdce
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-18_f2767f5e9149189537d1337605e1e977_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-18_f2767f5e9149189537d1337605e1e977_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2880
  • C:\Users\Admin\AppData\Local\Temp\2026-08-18_f2767f5e9149189537d1337605e1e977_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-18_f2767f5e9149189537d1337605e1e977_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3716

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 15.5MB
        • SHA256 37a6775e10f26b9522409f91d36ae95dc8f034ff9f84a8ad1d6c230d6a5a9223
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 15.4MB
        • SHA256 050cfadbfd2d6573afeffc4757571e65dfc69952c7a9716f57cd23602181fdce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.5MB
        • SHA256 00d95c6b658ea83de5c966ad618a02a117f10edb18d9e7b1a561c552814d143c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 15.5MB
        • SHA256 4d2024a73899999497e4d960a1de1ebfbe79c95790d3f9a582fcef981ffac061
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 36.9MB
        • SHA256 805610a594f6c4864a8bb8674acb846764d4b7affc86293adbe42845246ad520
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 32.5MB
        • SHA256 528384137f6a89ad517af8ef911f77b99e5133707a1f55c8e693bbd820d79df3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 34.3MB
        • SHA256 f629dc802dd3afc9b1b47d6654226df043704d2c084bbf3fd5461d82ababece7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 33.1MB
        • SHA256 5f5b261621c68272430f2694d4c53850ac831b1f9d2863bcd22b0595056ef14c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 32.5MB
        • SHA256 182b5de72befb109b84503c63afc635f0179ec309526df49e9e2e1a5030f1e88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 30.2MB
        • SHA256 5d5bfc27e31dd51cb9402b5147906872a74beb99c8f5961db8d4c26e53f4ca80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 32.5MB
        • SHA256 eb520d9c816b50a9a31468db0c4a862cdf9560748c56b690b0ec46f28b78515a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 30.1MB
        • SHA256 198def600042e44f51b8f587ed44d886e7fc3a2c868c55d87e8a86829ca2e170
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 29.1MB
        • SHA256 9c32c6713752e9edfedd4f9e80cbdc72012fa8f712ae0acc379866d70d2363c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 27.4MB
        • SHA256 8b0ea7c115ae65b08a0e4a30f548c3ab6122c9a2dcdeb7310d6916d76c619e0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 26.8MB
        • SHA256 e6f1b548c2f41dc27d851d1172cc84a4874333e3e960e5933d6f9d0173caafe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 26.4MB
        • SHA256 49360868183d7cccd48bd443959c7115fa16cbc1d23557d9177da4e640032c1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 27.3MB
        • SHA256 0286e4836075e11e35636c853935f662eb38b99a327289fc80c8c4f8e6cdfa89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 27.4MB
        • SHA256 b8154b1e4462fb8191f9b3a198e6be908c77c66db1257e4a35971c4f74ac6bd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 27.8MB
        • SHA256 4fc39bf4bce8ebf78d38acfeda62747ee35ba2c1f0b9ea224871c532a627755d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 26.6MB
        • SHA256 55bb20b93e936454b47f1f566b9d8b82eeb32ccaa5dfd6725bbf48d0092263b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 24.4MB
        • SHA256 fe296021bf2f241656964a857bdce2bdf0ca48c66bbc50dbbf3d40de89d80b30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 23.9MB
        • SHA256 9a24c23ef19ec172de3a5d6d6843c161ec04091f4f4716991d09461a3e973553
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 23.1MB
        • SHA256 abcc2019bf4b5d92d0c197b7cdfd12996977ffc3766991f74a184346314ba5e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 23.6MB
        • SHA256 f0d15b8327a0ede3a2c7ab4a61bc156a2161dba1a5eced14227f4e5fb1b2952c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 23.5MB
        • SHA256 fa17c6a9b20a3020db0afc7e138481e693831d5460c9b478264c8d396cafa69e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 23.4MB
        • SHA256 df15ab3943a87f92d92cf4ac4510b15a4d47502f5f827b6b01513a04604aa725
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 23.1MB
        • SHA256 85227645cc7c24ca0414b5cb0b27ef03e7a4f8d349b712ee29dcff74fa89b761
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 24.2MB
        • SHA256 b89130c01f520162ecbf70c32a8483415fcf8be62ad885f8126491d7f931d11b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 21.9MB
        • SHA256 1a7c37e93429804f1dac848ef1367f0e8888fca44f132137896cfc620f26d1a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.4MB
        • SHA256 9f313f2e89921438d4fc2235402e4a430454d7e095e7b058931de390d9397e4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 23.2MB
        • SHA256 0a82d5f6f529fb4e23023ad47b9086a71e41c30cb666db7aac22cf45c96c6dff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 21.2MB
        • SHA256 4abfecf26ea7603d57799d734c799bb417148c77f7bb94a1d3570f7e7937d788
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.2MB
        • SHA256 141ea9d2ecc2398f7606228aff56dafaadb0eea8a4e47ad8819e0061e3a3681b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 20.3MB
        • SHA256 7d23cb0f7284058aa172ef0e6dd826e9a7e6eaedd410f67740680d0c81cf9a72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 21.9MB
        • SHA256 7539dbf091a37f6d8e8d9e47ce1165d8f2fee063ec9c71771af381396f790b84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 21.1MB
        • SHA256 b4596a04a2dfc334e4f8587b370ca3ef5ca5b498118073c60e7ce711d7d336b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 21.2MB
        • SHA256 b1ec2e26d7929b1c7b67e77db0e267fa3fc519c6d4cd1f19810afe5e16e85702
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.1MB
        • SHA256 59486016ec8412aee0479159e0307e799799fbf2def1a4b46ffa8ce79e47a6c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 20.8MB
        • SHA256 705118bde66c68503850dcef9a4b48172b575af62b8fb139c8e35f6b2183c265
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 20.5MB
        • SHA256 7c6404b63e063887b988e014449cce8b42820822974b73fcfea37f775a11d9f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 21.7MB
        • SHA256 69bcd038c30b345b519981072af93c650bbbcffe972afd50c6b53dfa8880eb67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 20.4MB
        • SHA256 13094eec5a8cc8012cf2096636560a59157ec27d0723ff6c9bc322f7c9de3a96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 20.1MB
        • SHA256 6217a916c6aa74ae6b8ed13c3cd808aec011d7645d8e897284cb9eab6bb958ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 21.4MB
        • SHA256 28e114aa90de4d0f980b9eb67c9698b8526373babb1c4eb5eac616459c7b18d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 19.8MB
        • SHA256 e81d348a1716571f01c28e2683ae8d09fa0f3db860ef0a9e3559af309cd15bb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 20.0MB
        • SHA256 f4d23804bab5f2fd0c68ee12cc588a270d7ddb59c563b9207e400050b2509649
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 20.6MB
        • SHA256 b37312866b5d1e6fe6a5d14fa5d60474a4fb0f727783588c400fc25a5c6a1c9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 22.0MB
        • SHA256 ada0faf4a240b0a76ca45af41d180343367aa8b6a015ac5ec129e1e4e72a1882
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 15.5MB
        • SHA256 9092d8ee0849e1df0d3ad4eef1482cbf3cff6fdddcf8adc975372fc94e9e8311
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 30.9MB
        • SHA256 e24d185ea7d5da5a50bce1d24e88bea09be7a786edf98381f7ae63981ac02278
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 30.9MB
        • SHA256 ae62ecf3742a1465f6bce5e63e460d36cda13591a498ce1e8c1f8f6580a694ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download