Overview

overview

8

Static

static

3

2026-07-22...wk.exe

windows10-2004-x64

8

2026-07-22...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/07/2026, 18:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-22_27e5d9f21158326ecd89596ccca3c2da_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 20.1MB
  • Sample260722-wpmd2sem5v
  • SHA256 70054294e667af70f92e96b791ceb509ec231e35ef8b5b834c079d96305cde20
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-22_27e5d9f21158326ecd89596ccca3c2da_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-22_27e5d9f21158326ecd89596ccca3c2da_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4708
  • C:\Users\Admin\AppData\Local\Temp\2026-07-22_27e5d9f21158326ecd89596ccca3c2da_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-22_27e5d9f21158326ecd89596ccca3c2da_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3068

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 20.7MB
        • SHA256 a402b72fcf889b7732d8ce58c4fcdd62851a8f0c4ea05dca2254af74cc604f6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 21.1MB
        • SHA256 46c53b5db16d15122b745599a66b466951ce755bf5ff85059501343dbb101240
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 20.8MB
        • SHA256 26585681ffe753396a4f5851a928dc1cc26704b88ca73afdcd92d6e6b0aab406
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 26.2MB
        • SHA256 c321b93a0b2506851fc7d90246167c6391a7221e93cd85f6184c44f7488da0b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 22.4MB
        • SHA256 1602ecd530be5284f725291d6c27da8db53d43c17101461c42f9c03d94ea32c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 21.5MB
        • SHA256 cda65035bf4f1c370abcfcbae1b18de1f61c9d9c79758e1e8e76aff222ac4acf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 20.1MB
        • SHA256 31ac343b3f2a02678711dde7090109af2ce2612b7a87eb013cd7d683884f903d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 20.1MB
        • SHA256 815209cf21a6b8ff3ed14ee4db9b91eb7b0412e446c01dc0698293cc42c64fa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 40.3MB
        • SHA256 30620a8d1a8090e8c14c7350b5da450ca58809e37289f06ef39ff14b7c03f789
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 40.3MB
        • SHA256 5f161febc07d12554808f633c6817d257d3e4aa192646d6e5b87a39e1ad80d95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 40.3MB
        • SHA256 44a27f332255037a5932f167037c94a5adfcac16b8ed8deca23e301029975bce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 40.5MB
        • SHA256 c7a05a1d0db93da533132cf9b99ccfeb8dd0c0c72ff94b3b537fb8b9929e13e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 40.3MB
        • SHA256 204b0185495e1f3d2f3addd352d8ca4873774efc57d120d2f7b224b563a13d9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 40.4MB
        • SHA256 fe6826ecd7f3b635be1cbe1bc9319de66615385e383e00ade8631745d1040acc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 40.3MB
        • SHA256 cf51afc428a39ab0e74ac59290b7d77f90fcb93dd4c30b0e94af81dba35c4e8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 40.3MB
        • SHA256 6cdbc45c1fb9570e1c80cbe1dfaa98d86c7ba8816d139973181a587b2ebcb27e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 40.4MB
        • SHA256 765bfd82e1258ffde2eade3829b62a787e824e02c2a570cd6a64ac9b544063db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 40.5MB
        • SHA256 7f0be742bad9194d45fc007c27661fbf52447ce86cd263353b3e393729e69315
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 40.7MB
        • SHA256 83afe2c0ad64942b910e7f18f9e9577f33b27eed9d53b7dc0a5e983eba17c60e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 40.3MB
        • SHA256 dca9090b1cdf74fe3808b0906edcdadd2858ddd5182e0a6fd7f4a70d45b0fed6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 40.3MB
        • SHA256 a3567a6500d14ed6998ec5155105428203c6bea1ed9abf32f13c178b6200b79b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 40.3MB
        • SHA256 71d2506fb21d3002937b1125132782ae71e1bd60c46e5c53ceb6630e5b408509
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 40.3MB
        • SHA256 353a354638f3d2d20b836d169536e9c12920d3420020c1f19335f375fd21bdc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 40.3MB
        • SHA256 9a356dfe075b37fe06d9fa899913cdb87df2e5671b9ddf425588578b0b550efa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 40.3MB
        • SHA256 5c322c0fe1c5846d677dbf77d00b59eccf5a8698cbf06e90e6aae3266a0d17cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 40.3MB
        • SHA256 ceecbdd54f57b0981e8019d75775fe26c82482d89dbd975434e27d4629b22cd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 40.3MB
        • SHA256 b16aa12850da942f978da624cc201af63f0af3972e79391622b9fe1e175d72c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 20.1MB
        • SHA256 341f7aadd35e1b6a448d082c8402a9dae7c44920931126839078fbe9885b2020
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 40.3MB
        • SHA256 21dcc499c37dbf701aaa4006b2414b1d78d33d4dc7ce8f468c74fa467f2a1912
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 40.3MB
        • SHA256 44adbee0c0d77ba4dd16c5045ef9fe526da35b867bd41398f4b0622137da8c18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 20.1MB
        • SHA256 f603846918b1c09d13be9867eec4b9011e580d236208d1ecc0ce2f014fa5a38b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 40.3MB
        • SHA256 6656ebfafc6522dab557a3eaac1df32e03e4467c95b2a020613b9ffa9e638a8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 40.3MB
        • SHA256 0e467a93d91f1fca209c290fb607f960a5f9a2cb77c38ba2424d5048c20820a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 40.3MB
        • SHA256 424a692a9c417061886b71c5e147e1846fb79aba3c052545b36299764fe68c9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 40.3MB
        • SHA256 67229c97b044152ba08b12717e30087f6c733ca95a6da3f97a45f7869c2f924d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 40.3MB
        • SHA256 3639c1103b514127022fd81db11493e61837e578839aca8c7e595d2e41809e16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 40.3MB
        • SHA256 1e49e511af67f653270c4cd95e75dc67206a5ac1b209e031025e3cedffbd01dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 40.3MB
        • SHA256 4f688085f18a35851818edae167dd455f27be9f2ecf62a51bfbbf06986c3d626
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 40.3MB
        • SHA256 a6a5108f67327875b0415c889faf496dd53e72dc264d37ac1b396c94dcbff3e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 33.8MB
        • SHA256 c0758a74d68c81487414970d95037d46ded2e869c11472e83674f3a74921ed59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 33.0MB
        • SHA256 79c4b6385aa3786003c186ff5917c26102dd2898ab9b6ae2c34121fd51ad2a34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 32.3MB
        • SHA256 eedecdb66dee96286b1de71e2a477abe2b9970290391c8ea33f853e3589ae577
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 31.2MB
        • SHA256 40025011c06760ed0b1c09c32f1c6a66ecd85a95590655d59e393620545846ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 30.2MB
        • SHA256 94beb052f72a3584f1db35363106052080cf4c49f9bf967d34c7e7647101450a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 24.1MB
        • SHA256 e6836b69b73d8f699cfd7ec0575d71c0349c0856641348fff42c7c08b87caaec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 25.1MB
        • SHA256 66be7451dcdde13868d0c0bfcd6956e1f27ab62c7a7e82acfcf675d3e93f15d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 23.7MB
        • SHA256 e8b3c949888aba231e2ba71c16f66670a67713da92e38c3e342d4e64d38255e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 23.3MB
        • SHA256 bb82a97364186155617eecde8992dff17fcad820b987e66f0e45f5ce3a14c3d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 22.5MB
        • SHA256 75403804eda1f987824499b61db4a8675ad220883955d26323d4af3c401ddd84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 21.2MB
        • SHA256 b95ce88326a4daf081a4d4d6f81119d6f1520622d5ed01e198db9946f506837b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 23.8MB
        • SHA256 97a28b603f02c77c707c30d3b10bfce02a39911238a8bf8d283b147b0aca7252
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 21.0MB
        • SHA256 fe5b9222dfbcecf1a7c3df840b044157616579a389f2d06c6dbca139168c6a1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 20.8MB
        • SHA256 e401a6c66b86f65f530cddbf6a542e2f76c86256026430419216aec70d152fc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 21.9MB
        • SHA256 32a081241da4d57a7a3f1d8d91670f3d0e81e3df732d075725980a063268ff56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 20.2MB
        • SHA256 753e2afe478fcb41159811f5642dc29da18bb276f3e46f7342b8c43e6aa70f6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 19.8MB
        • SHA256 71bcb3d4bb460538fbe83e3c0fbacd2c1f59fa5021f2d1d4af462ed6bb50ba98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 20.1MB
        • SHA256 70054294e667af70f92e96b791ceb509ec231e35ef8b5b834c079d96305cde20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download