Overview

overview

8

Static

static

3

2026-08-01...wk.exe

windows10-2004-x64

8

2026-08-01...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 01:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_18befd7f19c0b64f6f4a3f4715200e15_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 39.7MB
  • Sample260802-bme7qs1fqa
  • SHA256 bc71bce7d8011f32bc37e8d910eba3331940eb311342be37821c871d182d9947
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_18befd7f19c0b64f6f4a3f4715200e15_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_18befd7f19c0b64f6f4a3f4715200e15_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4420
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_18befd7f19c0b64f6f4a3f4715200e15_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_18befd7f19c0b64f6f4a3f4715200e15_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3372

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 40.3MB
        • SHA256 f08b1c6c6497816e21216f9441eaedca4f24dabc38004e70975485a42362e42a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 45.7MB
        • SHA256 814a64eefeb0e7f1a30af73a410d34e345711a15aea3a2961643e3c7d7debb11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 81.0MB
        • SHA256 141cf2f61cee3048ce77169e9c8e850acfbd7484f80ed0723ae14ae8051523fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 81.2MB
        • SHA256 9a1f3218446c7869a854bd93708f3f55203b42039536ed9a5e28e7ec45185874
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 82.4MB
        • SHA256 f6905b2014704fe932356694cb385f03eae0db70d1fba1a566ede4f3ae2452db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 80.8MB
        • SHA256 df89814b7e413ec645c7500b44980b76c16ce87160b0032699548645ef3a8da0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 79.4MB
        • SHA256 dd4531c96928a7851eaa42f25a10d79164717395012646522c5281d295354e61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 79.4MB
        • SHA256 e570504bc06a92006818f96e7c5bc5b5fa229c4c0423095e61e2ca54eb3b3f32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 79.4MB
        • SHA256 75e00d2e794d072e8e4a445a4419e44801ce26e9b6d0a56420cf4038b3e6af34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 79.4MB
        • SHA256 ad73d06dc8a2306318f9af3822df09a4096d6d39b1e76ee8151fd70225109c44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 79.6MB
        • SHA256 1fcc99d061cf41160fe92e07eab18c9b2b7530a1b0efd4d96ea829f95375795e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 79.4MB
        • SHA256 e1813cffc3711ada2ff3aaa2085971447615fec0f9ad81a29ef693773bfd3623
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 47.9MB
        • SHA256 4672ff4ec75b7541fb4b24861b721c4e7af728f7f050dd6c406470c32f7e5be7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 48.6MB
        • SHA256 43e2131e5c64e806c7c7404efbe3fc3a30f69e0b0d4ed0909a8f42680c95606d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 43.2MB
        • SHA256 274c0b010729bfd6e17e9b64db92b77ce69f2d40115f1bfb08e1fe51d00babe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 43.8MB
        • SHA256 bc2a562d61b62bfa90df373030486008ddc4f4b95926863860f180fd7ccd09d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 42.3MB
        • SHA256 c79c4649f15890f628edf397b4ad48035fa869e73f3b0dc8c8f6a9bef44d5b29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 41.8MB
        • SHA256 40835500787b827cf6616be96f13bb23a3b8a5286de2a9c84b4e228cbbb4f619
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 41.0MB
        • SHA256 ca9fef8e72a4437aeff0300f6de8f700657b414c6fdd0223bc5aa2aeb06776b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 39.8MB
        • SHA256 b385c95ff8b08597843661a2d7db3b1551416d18679e8b7a7d15647d2a7c2649
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 38.4MB
        • SHA256 673a518eee4bad860ab4ea9848f235d63c983f4b5705b417353a322585512b8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 33.0MB
        • SHA256 38989861fad0f33b90266300de3b6099c36404c5a69a42a32aaef38324666f24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 32.1MB
        • SHA256 29358f49262d35f2c8560b70b29164083dfdc8c6b696b59e97f17a680e09d0b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 32.0MB
        • SHA256 f6870a8a62e805df5801f9aaffd5392f7005a5a6251f41442b48ab2b43f44119
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 31.8MB
        • SHA256 c5b7dd8f8f4759011c326ad398d534e2d4e4d0709c8d825510293862d09ef93f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 30.4MB
        • SHA256 05c12ab111035088768c200fd72552fd5cd681252b3e99338ffb68121f2f4a03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 30.3MB
        • SHA256 6e8591b7d1f3fb64ec54cba8a36dab16282382af64bd0991a10bc24cd199b079
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 30.1MB
        • SHA256 ed9d2a1e42b35eadfef2251daaeb2f00f5d87525faf834927716eadd2548f8b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 29.7MB
        • SHA256 2dd62f894acc0f1bb061aeb433dd0447fbc0ed1bee9eada39037a297d7ebe22d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 24.6MB
        • SHA256 317088df8759b1024b6c027e5fc073f6cb64753d64467cf8be29962ebcb973f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 28.9MB
        • SHA256 4524ee41a0f447197781f3083042b8f5d15a5fc7f4b060bbf7af51ec94f28df4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 29.1MB
        • SHA256 0f7cc335f12f316385f28f7eb1e206ba7a90979d11650f0ceff1a88fde73bfe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 28.7MB
        • SHA256 e334ce5047a6a615c8b32b9fcf22617ee95b6641d9208a38d2a9d092bb3fd90b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 28.8MB
        • SHA256 268a30d38196ae7b99dcc6cddb6d04612beca51cdb06c1b8233fc881c85cd290
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 39.7MB
        • SHA256 bc71bce7d8011f32bc37e8d910eba3331940eb311342be37821c871d182d9947
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download