Overview

overview

8

Static

static

3

2026-07-22...wk.exe

windows10-2004-x64

8

2026-07-22...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/07/2026, 17:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-22_4d1b075f8275327a564eefbc786a94ec_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 25.7MB
  • Sample260722-wfhpha1bph
  • SHA256 79e1eca187963c8eee0906da28e225e1c162c6923b67c56d7c7291e44b6129dc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-22_4d1b075f8275327a564eefbc786a94ec_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-22_4d1b075f8275327a564eefbc786a94ec_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4728
  • C:\Users\Admin\AppData\Local\Temp\2026-07-22_4d1b075f8275327a564eefbc786a94ec_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-22_4d1b075f8275327a564eefbc786a94ec_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1056

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 26.4MB
        • SHA256 7af2fe941ecf857008c3b6e14ebfe8f4192d08eb554250770115a0d37581b34d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 28.0MB
        • SHA256 525801be3eefd7b834736c3c54985e40ed2adcacb5a98b2d71fba6b227397517
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 27.6MB
        • SHA256 504cc21e52915e54d94f0798a0800f6e9f19b6d1605c161b06e7739bf148f0a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 25.7MB
        • SHA256 92b4350c64ae13fb96390dec21a7375cba8cc53ea0adf64234925887bdd536d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 51.4MB
        • SHA256 ef5fde159800f057dafb41aff6d940ac5939a8714e57bfff5ca0218c33839769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 51.4MB
        • SHA256 a683260ac24d08fefc7701e8679eba0b0d71bef02ec34ea5bc1df677f11557c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 51.4MB
        • SHA256 358d86af97543f05a495592f632db876022e392787a489143b7de9084da0fb54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 51.4MB
        • SHA256 a5a196b63379b47ab3bc6cdd7a4983094f08ae3fb38f30d0405255fd5f3f08bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 51.4MB
        • SHA256 c6b03a29ff3881b6671b23240fbc36607ee890fca6b3e60d405098d3b715ad93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 51.4MB
        • SHA256 76697f3e4f2d519440d963085731399a54d834fb7890cca647bfd6bdc1a8da71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 51.4MB
        • SHA256 3436d2b13d35a81c83b2c7cd6f0a063ea2d2dadb93db0c1271799e91e29ce70c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 51.4MB
        • SHA256 5f91cc9bbd58030f9c448e3b23366373a084cae25f0ecc2469f24002d6ac5c89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 51.4MB
        • SHA256 e0ee0f84938f591ba5b1d141f982f1ad0c75d0bcacaee1553839440318730def
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 51.6MB
        • SHA256 5667b484c4a9edf7a0d9381cf18e5fe7442f807795cd0c9e94d2ac67505bcfde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 51.4MB
        • SHA256 bcd4e04e1790aedab789bdd5f72827992edff40a7b0cd1d5b3c75585a0b25eae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 51.4MB
        • SHA256 d76a0a1b007e25107b032dcd2ea1174ecf216beeb07ff94492b78eacdd709961
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 51.7MB
        • SHA256 0ed3ae06d9052746e61a959b90ccc913bd1bef6b2b1dde4a6fcbe0e05a20712a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 51.7MB
        • SHA256 d78b8b738b5741261732c14fd1a7c1fd16c274cde8f50fb9d96c06a61a3882af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 51.9MB
        • SHA256 2f5ad33e95d288dad377a0921efd8c9cd57feccaa9e263ab8d43ffcafa999267
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 51.4MB
        • SHA256 34ba48be7bb3bf9c423c44fe820fc5940018b595d371745276dc7d4d7ff98cef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 51.4MB
        • SHA256 d0499b8a46e36082fa9ebe61bdf41e9dad2ce2879dea7cf91dc8112e99170f92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 51.4MB
        • SHA256 48b095ade92a809292f613be8535e47f257be8fc525adeff888d84a03e6fbfe4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 51.4MB
        • SHA256 0afcdc2c39beb2a262b4171b07119a17cd781d46a2ccc94dbdb013c654dc13f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 51.4MB
        • SHA256 46d58c4da3fc261ef2b48ea06ed750a51cc5250bb66d5f60b76b8ebd97f4fe93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 51.5MB
        • SHA256 8c4d95cf8c44f6ce3ed7891fed5a3787f6758fe1c788eb013f020f6d9085734a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 51.4MB
        • SHA256 4bfd24c83fc4ad1540c74175860c093cb016e0e0b487c04eee582e65af8d5400
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 51.4MB
        • SHA256 7759bdb581fbe91545fc8642e4cc1f0176e45bb5fc571f697cb98fcc51509b35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 51.5MB
        • SHA256 a284d29a35b6a6d8f5bf6c3798f84e450f54c84af141b38125f94a0bf13d0979
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
        • Size 51.5MB
        • SHA256 d4b53a87454b92ddd2ccde62af56a8767c13a8915fa96843ec4c051f6b3b00d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
        • Size 51.7MB
        • SHA256 88789073d062f1fdd5b070dec9fa27f6d6970d4bbcf28d50667c1884804347a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
        • Size 51.9MB
        • SHA256 36b3af25163ab00a86a80d56a72389d0729d9391e21d80dfb11767b9f2e52220
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
        • Size 51.4MB
        • SHA256 49310f7eb4a5b01724594a18f96303e2ddcc3ec95d459bf0d2575764bd8bdee2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
        • Size 51.4MB
        • SHA256 434b2eeff31fc57e618f80e283a0d08b7b8529866b778b61adfe67c7a174ce07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
        • Size 42.4MB
        • SHA256 eae4057f2195380edcb47eaf9a83ec8cd6e0eee1e1170441b159e66eda199390
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
        • Size 37.7MB
        • SHA256 f61dd97b0f2641c5f9bf91ca9242eed75ee82a920d58cd8e7410a947c549e0be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
        • Size 23.8MB
        • SHA256 39cd319d9225e08adc542a4734ce500e05bd90e80682f9168bf1f58d9555cc58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
        • Size 9.6MB
        • SHA256 07df31fd54e16a032f33f4e404cc44e92e866be78bcf83c0a1208a8691dd706a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 25.7MB
        • SHA256 79e1eca187963c8eee0906da28e225e1c162c6923b67c56d7c7291e44b6129dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download