Overview

overview

8

Static

static

3

2026-08-01...wk.exe

windows10-2004-x64

8

2026-08-01...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    116s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 00:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_50e06de3dab81fe06d42478c492d620a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 33.2MB
  • Sample260802-a4fdds1cmb
  • SHA256 d6ea368e58cb851ae394b2de223d14fbc1c1ee9e414b0fa2d7ea7fd50ebd7351
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_50e06de3dab81fe06d42478c492d620a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_50e06de3dab81fe06d42478c492d620a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4448
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_50e06de3dab81fe06d42478c492d620a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_50e06de3dab81fe06d42478c492d620a_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4024

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 33.9MB
        • SHA256 0206015c1584639317ffae91d28f93a96192dd2fef0c70e2806a0bb450c5aef6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 72.5MB
        • SHA256 8702da035f07deef0be3ca4732a401c74aef00c2d7877c3391b1daa4c960008b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 36.7MB
        • SHA256 1284347da0ecca5e9cd3a3c10b18b2e9d4c9413494df13899799d8907108b05b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 68.1MB
        • SHA256 38d1026b374e91de764089fa92a7b0aeeed872a9756cdf3a8cb236dae0462f97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 61.4MB
        • SHA256 18f4b994f5d854d6d2fcdf0f3261211743fa7db9abb254e52bfb37e30653652d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 60.9MB
        • SHA256 405d7b8057cadf454f04f8ccf8e37c2a9c252f53bc56c1469aa34e7898fbb14a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 37.8MB
        • SHA256 7103601a13c39247016891597089efe93d5e04485af3b076ad7d137732bb0a91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 33.6MB
        • SHA256 9cbe924690eb94f23a47121bb579d6cc1055a024c85355fdba6719098ad4752e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 22.3MB
        • SHA256 4dfb5d79ecc4cd34de03e9ac2dc733ff3b3396e6f07fc469d5f9d2c0ca440f10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 25.3MB
        • SHA256 bee0956e39c6c3625be83e22cf4c2c5b981434ff7fdf3464753995969842ed94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 20.7MB
        • SHA256 23d596148da55181a8d234821e76c5f5c8c31610a0fefe2ee65798f999b3aaf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 19.2MB
        • SHA256 8961cc99452469df3a989a6a3b1133ef31a5fda7224550735cf6be6a34d056d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 19.4MB
        • SHA256 e3121c2978258506838300bc10e72fd9d1f94cfc7438f982b0bfea178edb868c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 19.8MB
        • SHA256 31a79d22e429af1576ccbbdd10511028b3d86de3e576c46f495c71f5cb208fbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 19.4MB
        • SHA256 1589dfeb5f5efa15f48a1ef4a9fe46c712582a9c15f7d1a4f1cf5e4d03f67ef5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 18.8MB
        • SHA256 ccaaca75029b1f797cf45bee49db6e89b1d0af9ffd911f04bbba4db376a5e4a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 17.9MB
        • SHA256 66dbc53e7e0b913b6daa57efd0535c7b5653946a47063684494099cf1135103d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 15.4MB
        • SHA256 f8711ad38edd1b0c43f6061339c459e6cd03d90a855d23425e6178e464a30bc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 16.9MB
        • SHA256 f3b1568ae618f3a6fbccaacf3c9116db4e9f3b4d8c16211e3563a9b33104cfd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 15.6MB
        • SHA256 95033dcebb5c913d4b1278a3de20a7a292af2b00b41fefb5895af118f83ed003
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 15.7MB
        • SHA256 c4419f9e748389e5590a26968b7c61503162d537b2a9048b1f2fc99b847e0295
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 14.9MB
        • SHA256 0dc23526f8c4a769d9db5a09f9ec82bb9735f4c988d1eaa1c643822a7e8955c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 14.5MB
        • SHA256 9fc54b71e7fd77311168041f8a724e24721f5fe96208606652bdbdc21dafdbed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 14.4MB
        • SHA256 ee23ffce2376277b033aa126efc4436d0ce2062ca3331fa02c32676e97e8ccdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 12.2MB
        • SHA256 4b5f5fd52889da9bbaa872de974431d931b4c51d59f9288b955210215273bc60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 13.8MB
        • SHA256 6536cb6707ef229e1a093f2d45bd859dc31596578d391cbc03846b604bcc8072
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 13.1MB
        • SHA256 441d89aadfdd112a2e6b2eb645e97c6673d6f38347aa6b3e272d7cde0bc74f73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 13.3MB
        • SHA256 1c7089388d83db6345c6622302494e3389b28bc3735288dd7e759abc098b5ea5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 13.2MB
        • SHA256 a39c16b9d47ef5e84057c4e8f9a48ec59be15b66c6cd43b5c1dd96ff8c94af4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 12.7MB
        • SHA256 07c3749aa5f972d80cd33a71cdd9b5151cb6e8cb2c08419759b88f4cb2d7f4f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 12.5MB
        • SHA256 83405723ebdd2e40237c9d28156d3ae06f9c04c055588c13d70f3ca46d91a087
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 11.7MB
        • SHA256 3e5de1f73673769a6fb7f7e23379b7b43129d29a194fc721e891726767da825f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 12.9MB
        • SHA256 b82eb3a52928ea93d4814d6b01d7fcfc2cce464279a880354599904a1556fcf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 11.4MB
        • SHA256 5d7dee805b955a3ef333b1d34835f2f05b3bf192aaa9d522265a704c6e4010d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 11.6MB
        • SHA256 4c291d87ac133d241081e025e769e584227c82018ba7af2438755760d6ade95c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 11.7MB
        • SHA256 a662c981fd7bb3aaf84a774319d6df87c1e431775da3d2d7f99191e86b0100d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 10.7MB
        • SHA256 1d070fd06d5d0abe2021f99a36639b4dd559b13924406ac6d6c09c6f011df8d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 11.0MB
        • SHA256 f463a8cccc12659e3222aa7d80e6746f5ed3654bf67560ae4b5c1c4fd0060fce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 10.4MB
        • SHA256 639a8b6f526425bdd3d4362acd60358360096b31e9627f1530ee03841da04960
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 10.6MB
        • SHA256 4e8f05df77209a63b423453ab81e5c1e57af98f40b8cc3f7d89d28d498043aa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 12.2MB
        • SHA256 0a936b92b95fae6795e3038cd4e97a1bfe76b9ec3a23983233b5f06f7f8a6105
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 11.1MB
        • SHA256 666c9cadece443da57a19295f93f4e648784ebe83ed9cba886ac306c38dd6f19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 9.9MB
        • SHA256 bef2dc9a8754673ffc831a7c6bf2976eceed54b46d66466ce5836da74d98b11e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 10.2MB
        • SHA256 aefb1fde3b11ec188236ae35a36f52d5f76c29c3dc7556525705491ef2ea2070
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 10.4MB
        • SHA256 16786aec714b9fdecf30624212811bde651456fb52f1dd13fc7ea44eff566564
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 10.3MB
        • SHA256 dadfa9cc010d929f92d9ce7ffc0b902bb9c05194996055693c7084aeb060673f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 9.9MB
        • SHA256 640492dd3955496e8179015e3a5f8f6e1f59ecc822d7a7f66d435bdbecfff9c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 11.0MB
        • SHA256 8a5630eb35eadfde994f4889345e311f15fb75638cf00792f291b4885031cae9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 10.1MB
        • SHA256 9132a71bec1d5897b2ddaaa93628f32455d8a08f5378311cb498bbfccd190cdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 10.2MB
        • SHA256 7a8bc79e479e1e77ee859866d93509b1c0d32b137c2feee86ad50a4c8a824dbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 11.1MB
        • SHA256 393d9aa83579b022c02bb023d1e5fec270e23fd648b443ca3bde0091f5a4af47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 9.8MB
        • SHA256 76749cff3f482ec46986668979a1ab4baf40850bff13b07db0649ec0f6a9f183
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 10.1MB
        • SHA256 d8675834e4e273c4cf3916837ad9e6c9d80ce99e387528f4fe0a2d049921daa6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 10.1MB
        • SHA256 e1f422d2496bb59f1b0c5e1f2c55e27c76646d30f84d923f989fff641ca15059
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 9.2MB
        • SHA256 58b937b8220c08e7a18e7a0645209bceddaa1e95f77f1703681f71bcd8e97c45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 9.5MB
        • SHA256 6b6c977c74850fbe7b10dd88c59f82321e7d170635343dd718a88a22fe8094c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 33.3MB
        • SHA256 208bf114072a70b5026e92e369ae58057beb85c4d0d9c15b06937e9381794b9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 33.3MB
        • SHA256 7e250c29e52a1c7057356bf353ae35cc7031607bd981594aab40b6dbad4617b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 33.2MB
        • SHA256 d6ea368e58cb851ae394b2de223d14fbc1c1ee9e414b0fa2d7ea7fd50ebd7351
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download