Overview

overview

8

Static

static

3

2026-07-08...wk.exe

windows10-2004-x64

8

2026-07-08...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/07/2026, 04:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_629b0a68afd2898d7c5bcc0097dcb261_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 31.9MB
  • Sample260708-e7k59sbw6n
  • SHA256 d6d85541d7ffc9f67e6bc64c1547a65bd2463ea2cd668d485b13039bb5a3c34b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_629b0a68afd2898d7c5bcc0097dcb261_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_629b0a68afd2898d7c5bcc0097dcb261_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4588
  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_629b0a68afd2898d7c5bcc0097dcb261_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-08_629b0a68afd2898d7c5bcc0097dcb261_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4180

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 32.6MB
        • SHA256 5f0ad27aee60f0a471c00c65aa8d30d7f49b34845d1ea62ae2543e545c1aadc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 30.2MB
        • SHA256 046af7d2a8394a8dfc88eef40b77a7c8d9d9d509354e394b3085a6e5e87fe566
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 27.9MB
        • SHA256 46f0c2ddd8ea9c9587bc0818317e88f76ab9a044df950751a6b5de3eccb442c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 23.8MB
        • SHA256 5e0b0d98c93eb985a855d14bfe3da0e0b02fb9d4056f0b2fe465193bab6327c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 22.8MB
        • SHA256 363ea39a9eb8843bd69555235b24881b198d445db48925283be084c34d5fe0c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 22.5MB
        • SHA256 f3717dc0a038a9d96be1f4124966cb0461ba51355306bb380b31a181cff1fbce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 20.6MB
        • SHA256 fa738a232145550adf7554f6b4f4053f95203710568902685b409f41fafebe0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 20.0MB
        • SHA256 4d8a2b80419a353ec0e669eed97b6df76010675a07096762670b6ad220ea450e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 18.6MB
        • SHA256 2767912656fecfa00ae6fc90687c9dd5743e693c30850d340ea69ce98f6e1199
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 19.0MB
        • SHA256 1550968a81f2fcfe9d4631dda6cd608799df55d4473385b42a515357001c85b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 19.7MB
        • SHA256 81cbbda40b071302fb059f214b88017327da7c71489e6556227421c17c7a76b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 19.1MB
        • SHA256 c9f7bac2fd29a55a297553dba62a7347f92eb89b1518d87f6fde37f637c55c2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 18.2MB
        • SHA256 635925c3755b0bb884de36516fdd3c828684fea7fe79a72cfcb54c5a5edd1802
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 18.5MB
        • SHA256 cfb0657dc2744fd4e004a1b79391c99fac2067c885446fbee6ab907895fa7be1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 19.5MB
        • SHA256 5f0125a3882190d8d48c16085ec8cf38e93c9d2597a358b2f45f4a974a30b401
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 18.7MB
        • SHA256 91121f3a20b88bec0ced0cf254196b8ab7ddbdfbccacb0d04820d99a3d066032
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 18.4MB
        • SHA256 81c1f3eb729cff75b0366b105c2b41a669ad1c7e1aa39c9c59610e79c9b00b26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 19.6MB
        • SHA256 899da616f32a157ac8ec04a80aa11dfa4de6dae3eb67d546a9c6025ef36b7471
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 18.0MB
        • SHA256 03537168dca41731319d07d7cf59a04e5b0960239caeea27701f39dc96ad9709
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 17.4MB
        • SHA256 84f5f08f0e104440d701c0e2038bc35c80393d29dd49222ced26b9f7e3db805b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 18.0MB
        • SHA256 460656478d65eedb3307e6434f98dc0791de0ad4b945fb3f57dee046b2d8bc3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 18.8MB
        • SHA256 5a68dd6dd7c257ec164e7139565db6b5b2d87415c4889af08d5e37a487d845bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 17.4MB
        • SHA256 3e19ef5c029b9398d11f0fff90874a6740fd493fc463b0c7d8087862510db81a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 19.1MB
        • SHA256 f9a07e29bf892ad8e4d78c37b168bef2e8267170e7714d91e0bed123ac821aa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 17.5MB
        • SHA256 e47bf9d007e9b9493c9bafee2b94ac6d348ebab139fd3ead3a58e3ac094585bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 18.5MB
        • SHA256 90c0719d88cfee21a5362c49658318b0787fea67b1dbe45bef40acf2e295ea99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 18.1MB
        • SHA256 58b894204302623678ca9c16ca0c3484ff5c243cbff3fb82b95e062d75cbfbb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 16.5MB
        • SHA256 81edb6ce4940702db5c5ea84e82972c1892506bf7e4fe2429bef04d92c50fa25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 17.9MB
        • SHA256 27d449ca7f8a403c81f433553c89ab53df183ce5a244a9e85cafbb37acaf885b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 17.3MB
        • SHA256 12143b34483a204884650ff750e77c5546109f57263fff1967db6989be015dd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 16.9MB
        • SHA256 2d4910a9e44e384dbed49bec3abdb6c3bb4cd599387ab0254a1bd14003799fe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 19.2MB
        • SHA256 c932dd4aa07da330feef4b5c170fc6b000f12143cd8a75102e4f1c7fdb3ccea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 18.0MB
        • SHA256 b7ad196bfa55306ffe7cf1d15c0babb24ff4a18c55c1e51218436617f82e3db5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 18.2MB
        • SHA256 715b90325bd01087b1ab2a8cd79f01a5931a837da26d7151fa60d64b5082210e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 17.7MB
        • SHA256 de67878104d18483b89df8d39abb88e58e1358a798999c7c695e73d141549283
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 18.7MB
        • SHA256 841cb0f7b12097e9635954c8a3ab0c4f58ef7d1f0a2eac9fad07d60b40de1683
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 17.4MB
        • SHA256 7327487bf69880a852e06c4b526d7b8840634321282aeed1f4285e59ed263f22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 18.2MB
        • SHA256 afe201b0958da4ff4ef8e0144f18f17d73681cacae1adbcf3bf1188fe2d7583e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 18.1MB
        • SHA256 fab3f757768fc745e0de25188c4d27acea71442142dda5b13c08ece2d4946f7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 17.6MB
        • SHA256 000f974826e238253723cc14d868c69578e236798523adcae987e35583c58f00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 18.1MB
        • SHA256 2dc2b9103d98a125399515a92f6f4b7a38b550dc2fde1e8b4a3de83639ec0aab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 17.2MB
        • SHA256 30a29679fe9c3ed1eb1006cb57723cf2fa43f3525eba8cf21bda1e2f93dd4108
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 18.2MB
        • SHA256 3381cd1dacf9b7b594bba68148ead82fb5432550ec364046ee3ffb88ef528cb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 18.3MB
        • SHA256 d4c24eeb8add7418d4893cc5b30eb0a2344cfc17bc4b13eab03693ad6496e74e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 17.9MB
        • SHA256 abb5ea7bd1b3bf45eb84439777a19ebad39450e49a1021d73482665b9f4eddd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 16.9MB
        • SHA256 4542ecb3da963f31bd4be2570b0d2a4c0757b0380035c21d0c83db534e849237
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 16.4MB
        • SHA256 133568c203767b841c5069ea32694b9b2c8611df6402a5b07b2335c6f2c64ccc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 16.8MB
        • SHA256 d644bebcac0f2d3fbb0abf1ad37f1e2ef0914b650d0262069dc2dbc34e93fb16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 31.9MB
        • SHA256 d6d85541d7ffc9f67e6bc64c1547a65bd2463ea2cd668d485b13039bb5a3c34b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4180-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4588-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4588-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download