Overview

overview

8

Static

static

3

2026-08-07...wk.exe

windows10-2004-x64

8

2026-08-07...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 01:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_81f4da2ef7a264871d4ff9f35f401aac_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 12.3MB
  • Sample260808-beqnhafj21
  • SHA256 a2e07b217a2bc2c77e589660308e83083329ef74da49bf43fc0be77192113f12
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_81f4da2ef7a264871d4ff9f35f401aac_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_81f4da2ef7a264871d4ff9f35f401aac_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:556
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_81f4da2ef7a264871d4ff9f35f401aac_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_81f4da2ef7a264871d4ff9f35f401aac_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3148

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 12.8MB
        • SHA256 dda6b5bf912cc1b69250321e3140ccfa67ee15e8ac934a1bc0dc7d4cc4fdf3aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 13.0MB
        • SHA256 0f23c6e1485fef66985cc852e3d2dc7c7c56700b06de99cf47778c935291725e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 12.3MB
        • SHA256 eefe95f3844e371bf145f1cb283c846d0b51a85144d31db4af8f2c4e1d7e1ba4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 12.3MB
        • SHA256 dc5fb137f627ec38f57cf7e9e8b87d210bece39963fc65076a6428fc10cb13b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 24.6MB
        • SHA256 a3b9af4cb6bd35a0897834fd309c621a00be6d7692dcce3a44ead6de078953c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 24.6MB
        • SHA256 0b0f1b69d057dabef6f19f433d0d0dc6ec1d86bf2f10b0e1e07a841a6e71c47b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 24.6MB
        • SHA256 37f9369591038639c72082c0ba277997b4a9f88455dfcda49cfe8bfc4f70115a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 24.6MB
        • SHA256 256746bda02606e6b4c39c6a143c3dd5ba7d0f542d2a4e369d94962926eca1c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 24.6MB
        • SHA256 b476b7fd425518ef8d3569d2bc0df789666e626bf8017eb762be67b52f08bd70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 24.6MB
        • SHA256 ef1c69f7b6ffbc37231a3bcc2ca7c5cc1ab9e107ed4b9c725d081b5b2912fb66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 24.6MB
        • SHA256 61a67e0f2fe1baae94750659541ff9424c365eb5e161b7d25b304d8fc3c5ad19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.6MB
        • SHA256 8d73e93d023ff8036c04ecb75b700b5e92b5cace4ab85252a14a4bc3a9299a04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 24.6MB
        • SHA256 b9ba1dddae6437ad46b6e3ad95edcfcc83b284b16c396066b56df17df921b88e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 24.6MB
        • SHA256 dd52c339ba493d76d5cbd6dabb1c5c1c66f3f920d0399b3bc75f8c6cc20a0771
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 24.6MB
        • SHA256 1ae2f38d2ecea3c564c81580e5f1f878d4a6330689703724cb8bc56f39581fa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 24.6MB
        • SHA256 7ffc244f9391744e5c130cd513c87bea021970e71d94a1ec9e91e543db0eb10a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 24.6MB
        • SHA256 563ade976d85f3b2aa720fa1301be40173a7fc0e6c08ec212bb93253c81b392b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 24.6MB
        • SHA256 9b43bfc4a919571cab89a53c4606d4c855e2f3fc523a12ede6ee6022be8ae9f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 24.6MB
        • SHA256 e29728ebeb74f3638f8501984e1623f4ce330be464f6a97df44fdcaa59617554
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 24.6MB
        • SHA256 9e2804682c29d1ff8a6876b0b751d80c649dc212215a104879ae02119702e403
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 24.6MB
        • SHA256 c71e6073ed172f62820d02f9e8a195f6d64ead335ef04eca7a778022f1b9d56f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 24.6MB
        • SHA256 d95a4f9d9f053399612b021cbc75b2f8e60307705050523708a9dde67135113a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 24.6MB
        • SHA256 63232c2727bc7df6bdc4e6a6898a264110183ca280267131023c526f2e3db7b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 24.8MB
        • SHA256 ac53d37da844b2faa9c5f3de4b5bbd43050b939a92a1b9f723888c8ade758c6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 24.6MB
        • SHA256 8accffe9b6fc033e1e2107ff7db071e4c80c83fed54cde5a4b31087ca2b55726
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 24.6MB
        • SHA256 73da1892d75ae23f373ce98b116ca6812d2e37afa9f52436a3c5fbc27f328c60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 24.6MB
        • SHA256 411d0a4cc279d10278a323055c53e78d1cb6f9d5f625334ebccbff5ba917adfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 24.6MB
        • SHA256 21dfe622d193642e33aa0edec3b0e8916423d875d3602c970c67363957e2b94c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 24.6MB
        • SHA256 0817788a8bc77561a03b88558a7e100749f011e309fc57bbd780b11c83e19349
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 24.8MB
        • SHA256 ca8fde84ad886d259aee0943b64ca0ea3c87d06024584c8ae6204e105b2493c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 24.7MB
        • SHA256 9f51c57b3a04beda7054010c6bab9cf7ce937c857996627e2342cbbea2109915
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 24.8MB
        • SHA256 7712eb40930c451c021ef4b5dc78b8c683799c02e0eb8c4e2e0dd8f6f1c4c259
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 25.0MB
        • SHA256 5222db4757eb4eaf0f51449571c5d58bdf3c421228e19800ec53deda142cae2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 24.6MB
        • SHA256 1bf722fa98d564fe3d14a114b76b4fd067d05b03826778b77689191f306bae4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 24.7MB
        • SHA256 ed678e887ff0b4e1a62b645a432b2f05683055e1adb5b78f106e0b2959261b35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 24.6MB
        • SHA256 b2200dcc5d2b51dbc1c61555892ada47e736312d6585dd82cb2f5e9d81943863
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 12.3MB
        • SHA256 4810afe31465caa9472e3d8803e72838d7c39a1938304cf40db58833feafa0a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 24.6MB
        • SHA256 115add5f0fe08cd52cbde298348e074e80b59dcf47d7bbcef1a889a02bcecd9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 24.6MB
        • SHA256 5febe34084d325c360d4671c2cd22237c686600749be6ef233019f0de6cde428
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 24.6MB
        • SHA256 4f1da475ac989861d5f96595afa7c0c3824786033c9f55850ea3b1025dba81fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 24.6MB
        • SHA256 da62c89b75eb6b3904e7c07483d8414462e8307cda6d286235b5a32c913f800c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 24.6MB
        • SHA256 2240aa986bb49d6b977e8bbe28ea4e35261c18977ae37d57777e3e763ff2bd09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 24.6MB
        • SHA256 11ae70f41299c5845bee55f665b1e0d49464f3f5cec4ca1fcf135fd48e25bda8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 24.6MB
        • SHA256 9f73b97f4dd965f2f0adf78dc0f5edeaf4ef4eb13e8e307b6fc3708e6a92d69b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 24.6MB
        • SHA256 320af50ba4999fd16832b398e6fded20bbedaa53ca927708b1467a0e86820593
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 24.7MB
        • SHA256 bc9d9d0dbeebef475b127d68035b8f52a9134fdecada419ab9369baa73d55a70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 24.6MB
        • SHA256 2f035979ed251b26659ad4b7b54a191952cd20ad7658d8a2e309c11116d13dfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
        • Size 24.8MB
        • SHA256 4c4b8e458d4b94497d1a075051c6419ca8c166c837ebe2629951a98f0dc6d468
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 24.6MB
        • SHA256 7171fae98db8b41e35c8e772e9f577521d679203f2ba24ddd959be2427cb049b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 24.6MB
        • SHA256 9fdbe9d721887f73a8d547f3494bc6d87acac88967c52ff2f369c6a1a19316ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
        • Size 24.6MB
        • SHA256 e9accffafd2feb1f5fbce0f80e9f080b0f86c1befcd6d13ace81bc32060bc133
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java.exe
        • Size 24.8MB
        • SHA256 103a001b0b74a9dc824441285b7fce52c716cd99d7f74f039eeae6cdc57e3ef0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
        • Size 24.7MB
        • SHA256 47187136298c668a2410d7f6a872469d0857cabeaafe91d37e40f4fcba2502ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
        • Size 24.8MB
        • SHA256 cb8fe7e09179d211d7c27cdd629f8274c6343da5f88df4de54ac560dcbded46f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
        • Size 25.0MB
        • SHA256 eeecac07fca9c87bdc9a60b982c3e18072faa5fa8c1aa57617ce1d5ac521d59e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
        • Size 24.6MB
        • SHA256 e93af2ca81e9227fc5558631558b0dfc8836ffad50057fa395bde9ad109608f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 24.7MB
        • SHA256 a5dab96dbde7355b6d57449348945219b8b2fc8f2baa40681a0cff84ae32ede3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
        • Size 24.6MB
        • SHA256 dffa334df90d775b018c2306ec35fd39d8a36227ee2f4e5032987ee79cad221d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
        • Size 24.6MB
        • SHA256 747b58837d9c5eb9ab02c2fa433a27d9e6e15d2fa1fbc1aae7cdc514d7bf50c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jre-1.8\bin\klist.exe
        • Size 24.6MB
        • SHA256 0f4378bf74714325bda4ebd84e0fa82cae6aa3c92a7714e3626cbd3c05d4f036
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
        • Size 24.6MB
        • SHA256 6dd4d91d9f5ba0bdaac19d36207dee4ebf41f1d884a533e8eacb1440179167ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
        • Size 24.6MB
        • SHA256 2fe68508d60fbebe3946afb327be89c83793c9e09f16d0ffa765e0be7afcb949
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 12.3MB
        • SHA256 a2e07b217a2bc2c77e589660308e83083329ef74da49bf43fc0be77192113f12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download