Overview

overview

8

Static

static

3

2026-08-21...wk.exe

windows10-2004-x64

8

2026-08-21...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    62s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 09:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_a0cc21ee7a496e0112bb96abbd2bcbde_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 34.9MB
  • Sample260822-k4sc3axtbv
  • SHA256 0152f3ecb046087ae1a7a6f4b82b06fcd694c8a5ce041adb7363ad2d04fb8f7c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_a0cc21ee7a496e0112bb96abbd2bcbde_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_a0cc21ee7a496e0112bb96abbd2bcbde_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3428
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_a0cc21ee7a496e0112bb96abbd2bcbde_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_a0cc21ee7a496e0112bb96abbd2bcbde_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2384

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 34.9MB
        • SHA256 0152f3ecb046087ae1a7a6f4b82b06fcd694c8a5ce041adb7363ad2d04fb8f7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 34.9MB
        • SHA256 90b4ae6477416504649a476153819191878f14afb724367df825398ea391159c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 35.2MB
        • SHA256 324e0216ee37ec3d3683265a4bfd6609c77b5a614a0777f97f1b14f50ede0655
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 69.8MB
        • SHA256 22860737d646cb96ab030a5aa296d822cce87a613ce43db5d81485e71c84500a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 35.2MB
        • SHA256 747254b94c60e625b0290abfdb77e377f83f601530719eb5b460d47b52b54dab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 58.3MB
        • SHA256 de9313ee3b704e6e3e9c626750e80529bb0f736c3be62d835775803fe1b71592
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 69.9MB
        • SHA256 03e19a1f9f84fd366605bdde593f61463f8b08c93cceaf035ad24d6d55cb3afc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 72.0MB
        • SHA256 4be8e1b5117681f2958703aa950f9315e6be08c495297208c2e384c0ac4836e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 70.6MB
        • SHA256 10cd9070eaa6e2c8df3dd98cb4eddce980ddbb14280a5af922eb700696c3279a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 71.5MB
        • SHA256 077ca99fe6fafbd0d6011d855c9eed0582c952fe332d9ddb76e5153f4ea37f03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 73.2MB
        • SHA256 7fec87e5fb25c33af7c42b7f545ced8ac0621b8fa88a3a7c132287eda2d48532
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 71.8MB
        • SHA256 52d700943367b1d9a91ed02dc6320c6aa4ca19ef359b2f420e1710e8bd226abf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 69.9MB
        • SHA256 45f4821ed3fe767e953cc92289be287b78efeb50b9ca4646a9c612488c1bfe6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 70.3MB
        • SHA256 924f50107647bbdde0fbea887bef064a265be3cd853662a1dac8460aa5fe6af3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 67.6MB
        • SHA256 921ca48956eb93ea93105c77e36d3fe6da6124015c695ee04abe7abf34937e47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 65.0MB
        • SHA256 64dda186c21d539995b443b4f301eb6fad442e569f02e39358f6791d245b514b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 59.6MB
        • SHA256 8727ff9481be322d9ce3b9bf6a77d81380e47d1355ed1cfec8aeaab25d4b435e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 59.4MB
        • SHA256 558a4f3832d159b3da27150ec64cd473866fb25f6795c9fe039a32df7055cb96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 56.6MB
        • SHA256 dcd0deea28430858add699f985390e9cc8b951348465d1ed5d96bd096a831846
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 54.8MB
        • SHA256 1dcc95a1759d8cd2c5bba5c21463ee7f459b2c9705fe6369eb951e923d213b31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 57.1MB
        • SHA256 e07da3575198b0130f6f5691949bcc9a1d2b6ca0ab2869bc78d8595f042cb257
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 53.1MB
        • SHA256 8685c3859e8179eb7d8af94f3fba9c8c6979bd0475226d320f484bea57a704d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 55.4MB
        • SHA256 55fa8f513f926be741c0a928e62a9ddaf3bc741879ed86e3647f7382e3e15702
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 52.5MB
        • SHA256 b8e6c72956af63c01dee25de715d61f1a2de54a4baf14f4585d60ddb98a29c61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 49.6MB
        • SHA256 769aefb2b94e667a49a522846356913b4710a97135d4288e7fa6144b49056a52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 50.7MB
        • SHA256 81eeae21c65079e12454752959e34a2d2d8639ac599fc852b50f4be835f8a197
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 47.9MB
        • SHA256 f5c1ab376cd70b28dac94f05c21e5312612a29058b5cce9368b740810e540ca9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 48.0MB
        • SHA256 2dec37f36483f12e442325833309e071acd6c31e87199a546206f903005c32ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 47.2MB
        • SHA256 00b2ef09b11fc9f475840085ea377f8617c9ba956ce3d0de6e68a822de02e949
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 49.4MB
        • SHA256 772819f7483eff3291466db1d1924f1719e9125a803ae8f6b5fb1b31936492a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 46.0MB
        • SHA256 d937ed9aa87eb3386c3ece1aa9198a6a887cbec5fccb1b3df1724123c4beb429
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 48.6MB
        • SHA256 4a2b94d1e0c1c9ec1f21a895b16106250e94f9e9986fc9fbad561ad9456f0e7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 47.2MB
        • SHA256 1e383118956309977ab42e7fbf372f4148604703cf6ca3617353c77bdb469826
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 50.6MB
        • SHA256 7378e07550e3fa5a20142ff2d419f0489ade65799be5ad03b20adaa00745e0df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 45.2MB
        • SHA256 cfa469a51c625b7929de149b076121aeea8c86b073b093280a0e8d91c6ab1b2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 44.8MB
        • SHA256 1903aa914b6949c02f5acc825fb25f6eea6e5d9ecc0cd1494154498a8a3dab18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 45.5MB
        • SHA256 cd367de37ff64ad26e3ed6693d6607232431de33740074ab0a1ca2be7cf8ad1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 69.9MB
        • SHA256 459c546d4ca2fe0ba9b49ff0dba8e3987c3b32340c3fab686d6960872d3ee732
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 69.8MB
        • SHA256 e76f32d1850f4100bab46c5390ac6868e70f1fa9dce24b583e20aab1027959f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 69.8MB
        • SHA256 b04bd89305720c5b1a7691711faf6fe9f4dfebeba650f89de1e196bdc3248840
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 69.8MB
        • SHA256 db5b333ef72e61943c2c5a6be00f168994dd58c8361f9968bf8e6dc9cdf5d356
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download