Overview

overview

8

Static

static

3

2026-07-13...wk.exe

windows10-2004-x64

8

2026-07-13...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    127s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/07/2026, 01:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-13_646926f67bc638d81556b99a6a2bc451_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 33.6MB
  • Sample260714-bprcsab14n
  • SHA256 ef4964fb2ab1e78a456da875edc0b9aebfe89eed2bb0d54a6f506d26d28978a0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-13_646926f67bc638d81556b99a6a2bc451_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-13_646926f67bc638d81556b99a6a2bc451_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1876
  • C:\Users\Admin\AppData\Local\Temp\2026-07-13_646926f67bc638d81556b99a6a2bc451_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-13_646926f67bc638d81556b99a6a2bc451_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4220

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 34.3MB
        • SHA256 b65322a2ed3bc7ff4fe0108b11c7f465f45a78a0a9fb93e965f9cd74c5cedfca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 57.1MB
        • SHA256 8514f6789e925f5351202f9db50ddb104811ffc2e3d1c3c4774a623b4ca9dab9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 67.3MB
        • SHA256 a827d1ee94e5b47b2a8dbec29888894b120695110eab722a5630d478d4ade54d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 73.2MB
        • SHA256 01f125355a450fa4b03a275036494729e8eb5795f34bfae4233af600ef284105
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 39.7MB
        • SHA256 3f86a05fa4e6c1d0d4d7c94534ce9ce905d483d8903838da5cf9cf51963cf9b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 68.9MB
        • SHA256 4248bbe27dd3ab1d9c7a6b6a49edda5f9303ca475ba64ea72e67c2c172747eed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 70.7MB
        • SHA256 0bfe4340421efff96bc9b7087283546271b1a71e23338c09be670502f37e9b4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 69.5MB
        • SHA256 e9c5b5fa78b942407fe42156727da5c0d86ec3b2b22fef2d9265efcc6392f742
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 59.7MB
        • SHA256 0439e03a101f19a72f40567a6221cbd8b7cc8af543f03260f86c7b93c4e33354
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 59.6MB
        • SHA256 4dc38ec99432cb9145d0104d775acfb9b1c5dbfd821af76d3594c148effece83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 58.2MB
        • SHA256 13784d014f7804cbbddcc2d5d062aefdc67dd2c00efd4e92083217b12724eb9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 57.8MB
        • SHA256 79364cbc85f56570127ee7e2e496ded2da6144d5f84e7c255a4bfff578f85d84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 57.0MB
        • SHA256 45cdbe9bce98ae093e43f997f50f1592aa9e812928a6f7504150e56ab08404a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 49.6MB
        • SHA256 f2e24f961fbceaf5584462014963a3b5b835a32a3ff95dd7a5bf993559141b57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 49.0MB
        • SHA256 47206b6ae578c3b356be397969be068f74166bd8e784a69148a0392938683681
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 37.0MB
        • SHA256 5c09aaee4bd79ae600873307aba011eafd4afa46335f9fd310376f49ea584e20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 34.4MB
        • SHA256 e1166db5764b095dbb91eb91094485e8b2e9647983d4a32d49ca45e892522d2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 31.6MB
        • SHA256 a7e5e4b3b531ee75cc83dc9a33a013d9f53aea0c52f76d005eb1073b8ce35982
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 33.9MB
        • SHA256 7763ded9651d03c6299f9fe2c84a31490ad7a0f045ab8903255330444c6b65bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 33.6MB
        • SHA256 954eb01ac6bb8a6d15eb9e9f2d5944da5c5537d7d78f0b127f933809697b1827
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 33.0MB
        • SHA256 ced42ec678ec7452a6b1cb12c2134e9bf9f35fb28ec2433e171a3048ef907d92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 31.7MB
        • SHA256 1b3e33de5883be74063f078d964709afe1a5d58a259926cc70c9508f4936f0e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 31.8MB
        • SHA256 8059591e766a5f43934b854f13e48c896d065673e2ce39011af761f17033944e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 32.4MB
        • SHA256 49df5c57de6593c03a36f7285caa0a5b375099b197c6fe4f89ecfb10b099d80d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 33.5MB
        • SHA256 aa6a800666c1bb2ce54f05bda938a8127f58513ed88a2d6dc5165100dd2e64a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 32.2MB
        • SHA256 09991522a6dcf2849c2d47c5c291696e2bbdfe0e1cab45b31d372f2b2ac9eb2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.4MB
        • SHA256 3161c3a1996f4d22a59518c819f264063cc0b91bacdc467a5e3bd22bf672d0f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.2MB
        • SHA256 ce1fa02bba478345abbe6364f6fa5bfc576b77884e9efc571f48a8392df2e479
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.8MB
        • SHA256 4918ee5d5d5afca3788650c89f8127b2e1e3ddee43ad8c775dc76c59d561dda9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 28.8MB
        • SHA256 34be0be7ba32a65e34a4df17003f2661795eeaa25cd2a280d8910a69a88f7007
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 28.1MB
        • SHA256 d5b75c13ab5dec1ca2e6de9a5daa20f31ca02c94f2f737b9ba02d578f8420faf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.1MB
        • SHA256 51bf8eb02ecdc1e1b264eceaac139fe9d743150bb91e071e17f5bf113c0ab7b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.9MB
        • SHA256 9c8251c5d3a9cfce62a470b7fcb4b24566f4da4ac8c0a087c177ea68c65102f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.1MB
        • SHA256 0fd08f09bb9026d836c26f2aa01dbe5ed4be6b3cb640f461642a9e1916cfe7e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 28.4MB
        • SHA256 65c2d25cd8da0b28142eeec31837c796b250dbd7f28c265b5c33a88e0ffba224
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 27.6MB
        • SHA256 a4e2d05a25114324c32b9aa8b7c632137756b9878918842bf54969b4d82a85cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.1MB
        • SHA256 9deb5443b039a904f8072d65360502b4e463ad17bb583ea188eb27a9f8b8f4b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 26.7MB
        • SHA256 5f3b6717281eb7ddd36e52e207f3fd0868fafa2458fa7907de2916b2c246d246
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 27.0MB
        • SHA256 efbefab095e18fd888806386b248cf0ff64cf62510cd155c6a83d492bc9035c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 26.0MB
        • SHA256 4dfb858ec751e277692f5a4839ba5432a3cd53551be95897cf14c4980c32c732
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 25.0MB
        • SHA256 65db3164e7620df58cdb18ebe24aa793e1439e9d290eb66d2d1390c1ed9651b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 25.8MB
        • SHA256 2c65c5acc8f79642188789fbc1cdb5b6ebabbf1e057847c1c5ccc2cb324d3322
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 26.6MB
        • SHA256 24743a10dbfb79cc8964974d29b768c4c71e567ff8b6170aba43e588ba5fce57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 24.1MB
        • SHA256 1788677ec2eeed80a4474f6b4692dff2f44a4b6ca6600d362df3cfda53f2ae51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 20.4MB
        • SHA256 8cb5149c600cee8d1e99941f6e7233bc5851304bb81778d2822a4a954881e4af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 21.6MB
        • SHA256 95335c9c10177fe17f25cff883e5fe488899d2ca9f5e5d79d3ba5de0317d2ffc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 17.5MB
        • SHA256 932f5ca447ed0835dc2a7e30566b414e6297a7dcbaaf27327e604f5e6d0110da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 18.7MB
        • SHA256 69446ee2c10ec0dcffd341449864ebc29757ad561f35a93fd4ce36e4541b15f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 18.9MB
        • SHA256 e2d309f78644c8a456ad2777d21012d735e54e0296305d20ca2a4a5b4b03f58d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 17.3MB
        • SHA256 64f0aba80b1027bc0681166f9eef457ab58119afe1a96bdaf25e4fed437fdb7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 18.6MB
        • SHA256 520846bbdcc7c87df75b339bfd130fe99b745ea58b8c3f7dee5e598c58138b2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 18.1MB
        • SHA256 48ee97ab5865d9d4f2bc0cf49d9d5c289a9e14085d6bd0dc559a0c7e6ee75163
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 21.3MB
        • SHA256 f4551e84959e2b98d365a58d43aeb32669b57d8f0531cdb5bbea383a07d324ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 21.2MB
        • SHA256 264953d2b5d3325dbba05822451bb56021ece0bebd95d2b1b7dedefbf623e91c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 67.3MB
        • SHA256 fcac1e0ac15bdb3db7fc8330bcb6b4bfb54655faeeb66a0406263a5f9319494a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 67.2MB
        • SHA256 7d8df1d3330072eb644ddea2ba2a632804aa09a4c587c25172ba5acda9844e74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 67.3MB
        • SHA256 9b90bed9817e83b297be2090b4bb9416dd02ab6f75aadccf1d41f84d96c6718d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 67.2MB
        • SHA256 372d6a6cce9e83feb54ec72121b9b677868ec1327f1c43a21b9f09e0ba7f1077
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 33.6MB
        • SHA256 ef4964fb2ab1e78a456da875edc0b9aebfe89eed2bb0d54a6f506d26d28978a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1876-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1876-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4220-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download