Overview

overview

8

Static

static

3

2026-07-20...wk.exe

windows10-2004-x64

8

2026-07-20...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/07/2026, 10:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_0efbcbf3b8855e1878fef5b80f63194a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 21.1MB
  • Sample260720-mk3qsshv4t
  • SHA256 3f3b622bacb9e99d10e4ff1282859277dff330047e188c6173bf77b4f98cb43e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_0efbcbf3b8855e1878fef5b80f63194a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_0efbcbf3b8855e1878fef5b80f63194a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3888
  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_0efbcbf3b8855e1878fef5b80f63194a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-20_0efbcbf3b8855e1878fef5b80f63194a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4492

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 21.6MB
        • SHA256 6e14dd5e3251a161600a78441b9b21ff4e46c57bebc159a5e82d790659e7ae04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 22.0MB
        • SHA256 03fbad2529ef84f482ef1f17eb6e9f139e3c6f8bf92ffdd601adc94138d8685b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 25.2MB
        • SHA256 bbbdc6486c6e977220a6951daad3c9df33ab50229e3fe312711167d5144b496c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 21.1MB
        • SHA256 9af926414052f8d75642ccbb66daf13e241ef87f245bfd231a2856558fbbeaca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 21.1MB
        • SHA256 01353a232ad7a68dea6d1f3d35092b8580a2861b607f57a06b4dba81b342183f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 21.1MB
        • SHA256 ce0bd5309cf41ca7435c2547953e971062621fcda3a596fde11e3994ac6113ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 42.2MB
        • SHA256 7b78a5b122cfe9f79910ea69c5f8afe6ee09acf8deace11b465191b3d124f030
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 42.2MB
        • SHA256 2faf0701805f0eefa11780be751337f4e045b36ba2801f70b325381637f97747
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 42.2MB
        • SHA256 dadb17ce6348d98ae55a72846cc445256b842364799928661d0bfe83cf3e368b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 42.2MB
        • SHA256 3addc3f89d3b154aeee977fb74bea4e90fb460d6b1149da0f674469bbbac5656
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 42.2MB
        • SHA256 ef4d0c13f983a4853d1ac9fed0ba1f962b6858206463e195fcd79dd75b807039
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 42.2MB
        • SHA256 66cfbed0e596cd48c8801e53b1bfcadf00f0e45593aeb65e903fbc92e31339a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 42.2MB
        • SHA256 7527420df5943b7df887f814d8371219337cc10d775d777ec3f28bb82b73bf95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 42.2MB
        • SHA256 d16970a4d5e450e80ed48576eb338ca01e8f6bfe3bb00b106b676550e15d8370
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 42.2MB
        • SHA256 a67059e6adf7864bb4d0d2ec00fc94f3e082f64798d7b8e959fb78b5e40cdd2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 42.2MB
        • SHA256 6f3d63e6b7ad1aa4d239081891a9adb15bad61f0b343661da28baa6c75612aa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 42.2MB
        • SHA256 ad07d8456a52092cc4b28a6202e61af8f06c3f4fcc04cf9f5ad756532c8488b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 42.2MB
        • SHA256 05a3326f942d449c70b241607a0ca096471d84583c998ca5077394af0ffa913b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 42.2MB
        • SHA256 4a99281755d8e3cb1caf853495af10a3b5821b4946d23d7230d26d66431eb231
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 42.2MB
        • SHA256 993dfb962501849e3e52795715e4f8fb932ba8d92faf580b0d3feacd62d48dac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 42.2MB
        • SHA256 6a32f88d0e0ea15f6538db1b0532c3d2a070c1c8913a2699f46666e6ff19edc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 42.2MB
        • SHA256 6741c8f6c425a150a1a59ada89a04c553b6bc1af6ed779c01034ce0ca8e0f0fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 42.2MB
        • SHA256 21b87d4d8404fbe75d8458758f5afc054f14a8b1f00e4440beffc453bb1bcbdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 42.2MB
        • SHA256 34898f3aa15383f6f94b9f5758d25a2847c97d92be36d56cfa6eb9d1029f6912
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 42.2MB
        • SHA256 2a3f0b79cd250225ee8ac3e99a6c061525eb0da4e157524bbe1fd5031c498518
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 42.2MB
        • SHA256 9acfde4c889d9516c781146c39d97c858c3ef4bba7431f865f391657abdc7903
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 42.2MB
        • SHA256 7398eab0d9e620aacfbd10feaecaf22411e8520c40f8d0553a9c5d1c49f0edea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 42.2MB
        • SHA256 dc28e3f3ec432b8b4622221ad2ac3bf16c8be08793ffe0d1e00ca0b30cc982d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 42.4MB
        • SHA256 1f5fc5305e7b0564548fe1b96f832c66103aa810f126846fee67b137f039b01b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 42.2MB
        • SHA256 8333ca054eea5fcbb139cff482c9e5be37dbe83d64edbb407cdb55aa2984a9a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 42.2MB
        • SHA256 72243b1c468b5fab1e0caa37eb0fd3da01b29032e250a5a23dcebbbd6d8c1349
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 42.2MB
        • SHA256 ba23d11c73a74d033a9ae6c83e38277046b114432bfdd42de5c0fdb19ee51f81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 21.1MB
        • SHA256 60add529549b4ee1dc8e08280760dc84dda627adc133809fa42550b278e7be42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 42.2MB
        • SHA256 85a9fca14189efc0723ee137ca3c0baa7d527754835820fdb39acd957fa66fc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 42.4MB
        • SHA256 98a0e6e7ae9f4949cf5070bcdaada2d4549a19b89f8d903570eb8bca9f4b2a2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 42.2MB
        • SHA256 740d436a21fa0499ab6377525b022e87566d0b86acabb37cdf40b5f4d05f3e69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 42.4MB
        • SHA256 f1b1c2ac497e3734628548416240f345a3114d332b20da7bbdfbf66a5b457bc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 42.6MB
        • SHA256 f0fa7ec22838207caa576fa6a144676755844b63615118a8eaba5ce99b9e71bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 42.3MB
        • SHA256 738d43933b1be1dc277b1f0b80d8bea4bb08e4a75faf3128b9bbfde47b2139ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 42.2MB
        • SHA256 539b5e0a4b0f845c1a7429ced136cd0836043e108a04d9540da955661033dc80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 42.2MB
        • SHA256 39607081e723270cc61d7fa6c98646048e69607526533d49ea032a3d85b66306
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 42.2MB
        • SHA256 5aab467659cd72da7a6a17b7c0691713176318637e636a222a7aa0b1bd7e663b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 42.2MB
        • SHA256 6aeed7ebd76c24a72696d4c5cd206713ef2e918332d95d0761783d7767681279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 42.2MB
        • SHA256 0d5a1eafdd99f59924b258ce6fbd3ae42fdd151aa1b35471f87da52b1407615a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 42.2MB
        • SHA256 8713a559198a1af3c84c7d1a39be158421956784a28c79bc9df08afbf2ab153d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 42.2MB
        • SHA256 a598e10f837a7c5211068dd0fe809e4e8738c534513a74c0fbc4cfd47372aa66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 42.2MB
        • SHA256 920f3c94196a579e3dd5f7a301e377f6d67455d1e01067c29c5cef4bf153c1f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 42.2MB
        • SHA256 264850b61119bbd35a5d82a9d70d4c503fa3d7203f4aab4480bf2621be217e7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
        • Size 41.0MB
        • SHA256 ee8eb58afcd697c19fe45e51f2115e2edb9e938da6cb4b126bcf476e87c5f0f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 28.8MB
        • SHA256 097e436ed5d9b57d4ac8c1c6de855b21abfa7354142aca2faf437171096af8b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 21.1MB
        • SHA256 3f3b622bacb9e99d10e4ff1282859277dff330047e188c6173bf77b4f98cb43e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download