0fe3cb862d82a594f43396f97a28696d83194bb250f946eaed30c2f180d06d9c

Analysis

max time kernel
107s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Size 868KB
Sample260703-22txjsds8r
SHA256 0fe3cb862d82a594f43396f97a28696d83194bb250f946eaed30c2f180d06d9c
MD5 6e16aa4c783d59cfb67328e49dcdd622
SHA1 3d72e9872a5bf674f39b0087c64fb0a5818f5373
SHA512 bb98cca51315327df5e02ba186edf79157cbca5991ec50a6464cb55524c61b778722f57b320474bbe910a31a7ee5213e711d56af5bd349c69e5df28edb1e6c43
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2c:A3mnXoZjzyaT4aewsAjx9EaB2c
TLSH
T13D15B023FB7090B5C23B49715B65C712EB397C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/1908-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c534-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c5-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2e6-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1908-40-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3364-41-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c82-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a58-228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019845-265.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-446.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a55-550.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-605.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-631.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-748.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-828.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-859.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-878.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-923.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-936.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-956.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1012.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1086.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1154.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1186.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1223.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1345.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c534-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c5-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2e6-39.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c82-60.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a58-228.dat	aspack_v212_v242
behavioral2/files/0x0004000000019845-265.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-446.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-495.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a55-550.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-605.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-631.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-748.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-828.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-859.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-878.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-923.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-936.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-956.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1012.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1086.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1135.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1154.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1186.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1223.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1326.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1345.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1371.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1386.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1402.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1403.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3364	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1908	2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
3364	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_6e16aa4c783d59cfb67328e49dcdd622_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1908

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 868KB
SHA256 0fe3cb862d82a594f43396f97a28696d83194bb250f946eaed30c2f180d06d9c
MD5 6e16aa4c783d59cfb67328e49dcdd622
SHA1 3d72e9872a5bf674f39b0087c64fb0a5818f5373
SHA512 bb98cca51315327df5e02ba186edf79157cbca5991ec50a6464cb55524c61b778722f57b320474bbe910a31a7ee5213e711d56af5bd349c69e5df28edb1e6c43
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2c:A3mnXoZjzyaT4aewsAjx9EaB2c
TLSH
T13D15B023FB7090B5C23B49715B65C712EB397C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 cf54523e957195c1828c450289def5abda6ec2472e5d27979fc2e606434819e3
MD5 b14e5959ea0c559c6367422d96ca924b
SHA1 a2455062f9982533cb47f2267922933dc61a0a54
SHA512 351b2760a5f453b922ac5c9b3ef29e89219c34505a49a51b859cd043a5248866930891deb66299459c871e2240a7717076cf67960aaa7fcc99a655d377a7fc52
SSDEEP 24576:A3mnXoZjzyaT4aewsAjx9EaB2k0Le5ji0hmxNrM:A3kMPljlPji0Aj
TLSH
T14C658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 883KB
SHA256 0f2f35f40c6b7d9338bf65274e715f86c27ea1928e7c4d876ab28982fb0347ab
MD5 b8cf62649bea0ff066fae81524d64695
SHA1 df36977ba6b09d2d3da8cd8635c85cf66d3eb171
SHA512 be4d006a571c02f0aa9b96bbdcfac949c7524173e897036797d664a042f86aeea68fd8f3d2ea773f0512c833e3f15f0cdb49e832990e42c89d4633c59f12c043
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2Oa:A3mnXoZjzyaT4aewsAjx9EaB2Oa
TLSH
T1A815B023FB7090B5C27B49705B65C712EB397C210B6056CBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 916KB
SHA256 81b1d5b911872a1ee20a14b20fd8d8b66306d78a73bfeb76c98163049e9ac9c1
MD5 204ee36ad661d12b3c6d737cd4216738
SHA1 77c8c2a28d4d520a674570645b86031f6f23aa86
SHA512 e492dbff9fa76cd4cf729936b9a2f7388b78657b4a8eb5f699a31cdd2db24fa1551339f79f6de3ee22ff507358436a66c1a72e7c763cf28fc11ddaba821b9017
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2Nb:A3mnXoZjzyaT4aewsAjx9EaB2Nb
TLSH
T1A215B023FBB09075D27B49705B65C712EB387D210B6056CBE3A88A591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 892KB
SHA256 1e5435b9c33a48ce3350ac3b74dd4d96cb641882f5232074fbad840e4c327dfa
MD5 8b40021573c0bbac5a54d498ac35430f
SHA1 768932b0794a21b29ef8a3130014449f75ca93fb
SHA512 c5f91ec58934b3607881b278d653455f1cf3010675042bbccb39a42a36c96ebe21d4a348e86a62f4e779c2d90d374c18e9fce8004383388da5843c11337c2c8a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2v6:A3mnXoZjzyaT4aewsAjx9EaB2v6
TLSH
T1AA15B023FB7090B5C23B49715B65C712EB397C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 892KB
SHA256 1c568d69fe5b740186ef0cec598208a384f6357ac0d5a8e6a8ae9c26a9762269
MD5 bac25566371cad85adb1c36ff454f59f
SHA1 d84db33b22c6d6831d419e84426091be8d59d312
SHA512 4a7e5784c7b9ac4eaed52bc43fcddb6a5be76ea16f09c0261328c07e4777c7378a3976690b3d016bf42babad14b00b9d7da3067c293e012705a3e8ac5a97d27e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2xN:A3mnXoZjzyaT4aewsAjx9EaB2xN
TLSH
T13C15B023FB7090B5D23B49715B65C712EB387C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 892KB
SHA256 48b6086489fa3b9ff3e86d2df2cdacb38b24a70bcd24b11c0b9c7128aaf10c05
MD5 7a8f38077dcf352719983fca5341f8ae
SHA1 c36ecf4750962cd35b6f1c7cb74737363cf14b93
SHA512 a9f4e4783fccc64ec3d63bd96b65e32580cd41000986b7ca29b0cde8feda6cccc0b4d25f5af339884cc03186d1bcb71458b08046e9a25d944b47223e37384c3a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2nf:A3mnXoZjzyaT4aewsAjx9EaB2nf
TLSH
T1BF15B023FB7090B5D23B49715B65C712EB387C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 892KB
SHA256 2012d409816d66e498edf99f1d55bffdbf482346d0481fbb2533fec8f711030b
MD5 fa7b461301a81b03a196a913b1125ce0
SHA1 a915b19dd52f8222bc3a5ce9fbea890c8642b592
SHA512 fd6c246c407e3427e6a1fda201e0177bd99564ded32280abc7ddfe416a5df75ca116a59b17a997511400f622d5a9590507d295c614843772aac47e6fcdc070bc
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2po:A3mnXoZjzyaT4aewsAjx9EaB2po
TLSH
T12B15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 892KB
SHA256 e00a46dd9813587038aae5508f6a96e9fdeee76f7e378d82b65662374ecee4bf
MD5 f6667e3aac21122310d684d457a9c957
SHA1 931537832cdc74da7def5241dd54532798b2aade
SHA512 20fab8b330d6dbd18559d4e8476903923934844e2dcb902238f49a3c5ad2116a8916208eee90b2c3b482a6a1de124775be89c5ffb256c82db2a574a8a8cb56be
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2Zu:A3mnXoZjzyaT4aewsAjx9EaB2Zu
TLSH
T19E15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 892KB
SHA256 f501d29db27e52bf8ef03ebc312040b2888311f7d78fff5fa5add0ca22311dc6
MD5 319b1278e8300a6db58cd788327d1be9
SHA1 5771f0c294cca60fbcbbf9c7b07d31e3cfd7c50b
SHA512 a3a46e1ac8556d4aba423474c8ce42dc4492aaf28d3d5e15d67b36c4576efe9fbba15a441137c1bda3617536efd4af3992fe35ee15c2e212fbf9c61cbfc434c2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2/9:A3mnXoZjzyaT4aewsAjx9EaB2/9
TLSH
T15B15B023FBB090B5C23B49715B65C712EB787C210B6056CBE3A88A591F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 892KB
SHA256 713272bc372925b9b738ac0d2086749c4929d3116d001ff846c39aca0119018b
MD5 ffb772bca2afbb684b1f7421033680c0
SHA1 7d9cdd23755cf87f80ba8fe7538bd28cf4a4c596
SHA512 c4fdb0c89421eaf0a96d88ea59e6afb4a1c9b2369bd6c37c704ac36f08e4b045e0e20daa6f241a36adbbe8aedec646a4958001a07acdd4b105117fbb2e3f0972
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2bc:A3mnXoZjzyaT4aewsAjx9EaB2bc
TLSH
T1DB15B023FB7090B5D23B49715BA5C712EB387C210B6056CBE3A88A591F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 892KB
SHA256 88964602ad2cc0bdcba9dca0fb432b48fc8680a23afe3cf9d6daf135874da0a4
MD5 1e9649984b9abde1ca850c61a5ecfdc1
SHA1 de487335d67ee6ee930d510482fcb3d6afbe6cff
SHA512 89125c7ffc0eefaee1e858f9e9d7dae273333a425f481353504e2e3aec291647eb98235789bc7f590c2ffb3ab0e465ecb42e42aae21e8f5a8361d98fe0ab6199
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2Ep:A3mnXoZjzyaT4aewsAjx9EaB2Ep
TLSH
T13215B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 892KB
SHA256 6af4dcd10188aa71bbb0252864174eeedf2f8203ce019dbcec678886c6f886ad
MD5 68fc219790e2c561720e0bf61bc54fd4
SHA1 bf15653e6d62d0dba021837cd7ddc6b7c446e224
SHA512 6ac45c0f05c36d377035a01a8afa9c1a825b8e79e077ce8d4ed721cd81bde2088623b014a418ca2402c32e5636483d874a88e7a025ac4f248538066a20784765
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2L0a:A3mnXoZjzyaT4aewsAjx9EaB2LN
TLSH
T18515B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 892KB
SHA256 b250b07ea016aedd648e1dbd7a12e0b306cf4fc4bb01e4bfae8300ed453c9deb
MD5 e0adaea71ef0ad5c95b49663f9e00a5e
SHA1 70e10acc75f5d9b1c1d4941e7a33d68fa83fe848
SHA512 f33f3f1132c37f86fa9e989f2a736ddf3bec2dd93bb9809ced68d8a59b8761071de3d5a50832691c5abedca2c7302fc4bc7dab9ffbc69fda7fa799237dc58cbb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2ZF:A3mnXoZjzyaT4aewsAjx9EaB2ZF
TLSH
T15F15B023FB7090B5C23B49715B65C712EB397C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 892KB
SHA256 93d844f638a6ea04d92b3260895bee739b6c0a9c90059a85d802c639e199b34f
MD5 1efcb10aeef1c9a38597113c332090ae
SHA1 e82971344647a841a96e57378928cb8ac5da257f
SHA512 63c5cc9ee02e4e30fbd4096d2c2bbc6b7059fbf0f531035edeb33892922e8ba396a08a24658125279fa2612595fc05b87117f7d7391d7ac2613ff41eb430f6ab
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2yC:A3mnXoZjzyaT4aewsAjx9EaB2yC
TLSH
T12E15B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A88A591F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 892KB
SHA256 4f9de19136fec481d1f9b05c12c506c1dc307154bec51f796fb1a22f98dc5ce9
MD5 613fceaca890a942b3570a04a646073b
SHA1 b795db9dc98a0428378a810fda44ead65db3c1bd
SHA512 a502c7f317e15c34086e46927fc32645c229dcc40b4c71add9d0a474953d02c798c1e6c464e10dbe464f5f0d8048b8a5b3409e1298f36dadeee85d6ac7c51728
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2tw:A3mnXoZjzyaT4aewsAjx9EaB2tw
TLSH
T1F115B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 892KB
SHA256 e697b6aea54c8f9d8717fee657f64d8d9a1cc4be98292229075617609dc4ebe0
MD5 549ba48440a25804df5ec5ae2ea6415a
SHA1 0996b5c023ea409b11193649c414d063962ca65d
SHA512 cd7755ea7e3eb31dc84e4c733e47b1886fdd7707e115281e2c28c576b734135dbbf0d0000beae2558d26835cb43228c70137242c165ede4d996774117235cd7b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2cT:A3mnXoZjzyaT4aewsAjx9EaB2cT
TLSH
T11A15B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A88A591F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 892KB
SHA256 3cff8f7f638f78ebdc5cd957ad3f4d2804c1a36fb4d88c90104e0baf24f6059c
MD5 6adaf73c367ac42524ee64e89ae2fe4b
SHA1 c36ed939f41209c0323ae79def0408c03785d655
SHA512 776e5e77ebb0802a68d21a26c024a564323c10aa239be6f8bd2d8d2bad95ffd0468972a1d33aa684a4ee5b8c1f54713f695d10f43e0841750140e001eb2ba30a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2wu:A3mnXoZjzyaT4aewsAjx9EaB2wu
TLSH
T1E015B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 892KB
SHA256 8946851c5c313e6e01abd5a550737859249c054b2ef8a9f63233faaaa80c2a1f
MD5 3de23adb111dc42a5ac39056619714e5
SHA1 f4ad63193e2d2663c95690db8eb072c072c723ea
SHA512 30e8b13dc18750321993fe2460f8f81ac1cc4de917946b6d701604e6fb3b6ff94dc45834f1a47af5f2580dd6262e3c9892fab2fc7005dd1e2bd5c4f1ecf81052
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2Ob:A3mnXoZjzyaT4aewsAjx9EaB2Ob
TLSH
T1F415B023FB7090B5D23B49715B65C712EB387C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 892KB
SHA256 82abff4e22695ce83ae569784a52f690d2340132d88e243420e8b6f1618c5bc2
MD5 bf15a7115b02aba319f7e3b3dae9462a
SHA1 250dab2d197f996e71bd83959a3eb95821b46633
SHA512 de7f4a5683b62638025924ae0cecd6c18cdb62578dc8efe0a9ea999bb234999031895acde5b0c5c0d4866d60fd6b38054ab3128ab4251acf60bd6b018a80ba81
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB24f:A3mnXoZjzyaT4aewsAjx9EaB24f
TLSH
T13915B023FB7090B5C23B49715B65C712EB397C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 892KB
SHA256 d43fd3854adb1e5f12c00fe24dad9c208e5f14a72acc69fa6cfc92923e184efe
MD5 f3933ff779a430e3f6fd2cf3f14406c0
SHA1 dbb7a57036f51fb36b16d337376b6fda64461289
SHA512 da063abf3dcd1a273a040ebb61735ec7bd21f21cb750bb0b121d71e605a2200848a5fdbddfa93e1e07b91ad529eec3d447dbf090a8ca5a352913219ef618314b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB21K:A3mnXoZjzyaT4aewsAjx9EaB21K
TLSH
T10115B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A88A591F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 892KB
SHA256 b3183debf97baaeec37b19141cc162ee7f889b8a90ecdef0e85b6d835a52db40
MD5 b34d8e6b96449cb76a950e3a28b51e33
SHA1 f4e8f36f45d08ab6f9418e0bceb68f35c8e95791
SHA512 bbf1064262bfb8e4f5549726a87995c25c9342f1611e80d1689c4160e10a143786f9ca9db8907dd45ffce1403d8006ab16006cfa13f156302d0984d12e9266a8
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB22k:A3mnXoZjzyaT4aewsAjx9EaB22k
TLSH
T1FD15B023FB7090B5C23B49715B65C712EB397C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 892KB
SHA256 faabae251b19829a5b1dd1050966eb7da0d5cc8fc5fe8121a430ca14dc0cd141
MD5 6023c28ec9bb523e9a65c447770ea54d
SHA1 ef97150e5fefb20d92ae2f7ca5ee15ee6df88e6d
SHA512 3e40cb2b03ec1902542f6a021fad342811d1870df052e296233883b5c3c7ef76e49c75121b4aca8cbd491ad0a3416d2a43638c1bdd93e6ece580a5f0ac3e77bc
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2T0:A3mnXoZjzyaT4aewsAjx9EaB2T0
TLSH
T1D615B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 892KB
SHA256 2be025380c31b87947603fba38295947740eb3da131f27178a05757a8ae5010c
MD5 7656b76f5cee1935013e462be3cbbda7
SHA1 1009ca7b1c77b3bcd8c32b993ccc89123a4b4b6e
SHA512 35deee52719f5adbb92b0b47d978f1a19ed22f90a458ee5219a18066fff90dc7d3ab1a25b23a2631d265bc8449538926fc66de2d1d8ed009a6032f348219ce60
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2i70:A3mnXoZjzyaT4aewsAjx9EaB2ig
TLSH
T11F15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 892KB
SHA256 73d1ac29e2db63ccc7eefe0d1b7146d5a1d6203cb9a4c2452024654ab9f8535a
MD5 493786ca784fd4c6ef4cbfa7ff5f81fe
SHA1 df03e1b858dd33ee144b3a852f8dba0ecd7529ad
SHA512 83d53038958fd8b6644a9f794c0be84a1734add4d522552601fdf746e5917938284e71ab2940d45f47f5aaa7a6a5777bcbce9776426640e9d2849f4963653813
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2Dr:A3mnXoZjzyaT4aewsAjx9EaB2Dr
TLSH
T18D15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 892KB
SHA256 4d79160c310a3f284a7621eb79d77b99f9f3b9224a722498e4352a01842e8b11
MD5 64e9e59253beff7306305e630d5aa232
SHA1 249ff25222b87515a1f11d14517ac4b738875eb0
SHA512 d30fe108a7959fa02c2008a699d27797b1409e297c33683df369bc60b2e781794e5bf7b8069657deb649f5e2a678a04134551c656667c7b153869170c0573eb2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2ln:A3mnXoZjzyaT4aewsAjx9EaB2ln
TLSH
T1F815B023FB7090B5D23B49715B65C712EB387C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 892KB
SHA256 46993dd140c6e808ab89d6f5a6704380c9e607e060f413bc0a94754600faa109
MD5 57df1cc50390df46d7dd14ffc4c4bfd3
SHA1 b10c693e9e3abe5f7bcf0071558e4465be2d1ec8
SHA512 a8b64a20ec310366c7f281784317c1a9e4fd305d62fb0781dad39fe14cdc4c2cd54e728b75b980894c4414bd80a1fd7d4d5ab47944aededae7ce29b3ccf039b0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2Rx:A3mnXoZjzyaT4aewsAjx9EaB2Rx
TLSH
T1FA15B023FB7090B5D23B49715B65C712EB387C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 892KB
SHA256 243939bdbe86a59da1cb8a9e80583a98a5b650ec0b60c32d0e4cfbb5ce6065e8
MD5 23529c6443ae552a960f839249fcdd6f
SHA1 b59366b9e84df840bc042b1e8543a3a6863ea610
SHA512 998ad8a5023aa5186447de5f80c6f1c47226030a4440ecd3147b7c916a0bf4d798286c4099d26b10ee7be5c2a45490e3e929b1d970e5e7e07d67994748ea7e73
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2/A:A3mnXoZjzyaT4aewsAjx9EaB2/A
TLSH
T10815B023FBB090B5C23B49715B65C712EB397C210B6056CBE3A88A591F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 892KB
SHA256 e220dad056f15a6f525ea3f370128daea7ac3f1e049bcfbefb6ae12f94df1936
MD5 5584595128509ca1e1fa8680e50d97ea
SHA1 64497209fd5ca9d87218e5d6faa0bc3316569765
SHA512 946e66d6677761186437ff30cec344ac6cddbbe06aadcd8b3295c87a7ef613b02474f209ae5e4eadab5430df68b28382a932bb08a25b179ff6dd73b9a86264ae
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2Q9Q:A3mnXoZjzyaT4aewsAjx9EaB2Q9Q
TLSH
T1B915B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 892KB
SHA256 8ce7ef640f2aecbf348d4cfae947d53299c156c6eb0950da38bbb42595ec5970
MD5 016e5039e1f9140c1ac8bd43e795769e
SHA1 a52529c8d8199536444c3e2478f16ed9a37038cb
SHA512 4cf26493a8e21d6be0631718bac4b5645af5874dcf8a5465e9e225f582b5cbaa5b9fddcff1d2b4fbad4197b51a120caa7c8c8af6188fcbc6460ee81ef7f450db
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2x4:A3mnXoZjzyaT4aewsAjx9EaB2x4
TLSH
T16515B023FB7090B5C23B49715B65C712EB397C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 892KB
SHA256 0235e885fe066ae5584c196b1e81b327128dd799c3c44e2dad91a477e28c525d
MD5 8abcd5ce52196a4440e93a440894a71f
SHA1 08f48442eabccbeaf9d54dd46d5fa8887e53fbb8
SHA512 48ef8611d539683f941bddcf277bea82b9d7b7b1bab9adb2da04b7d661b129b77cf542179629355c7b5bc895aadc858fe5d187919edaa9a12f298b1f935b688f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB20u:A3mnXoZjzyaT4aewsAjx9EaB20u
TLSH
T13815B023FBB090B5C23B49715B65C712EB397C210B6056CBE3A88A591F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 892KB
SHA256 b9c6c3e67d239e06f6fe729532c090a6c549637335d82f49cfc1116891d120f5
MD5 a29927c4d68502c65cb9f891d3ec8a32
SHA1 ef384b99adc333c2196a653dfa8210a6ed0b5511
SHA512 af0375d9321cdf173e33b5fe1c0e664ce3b4ee522b7a6748fb9ee3d16d21a561b3ee0888801854f310965fec20a0d91af66182cd232ce010d0e81c963abf40dd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2Fj:A3mnXoZjzyaT4aewsAjx9EaB2Fj
TLSH
T18F15B023FB7090B5C23B49715B65C712EB397C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 892KB
SHA256 03821c212a77add148f29810b8b66482291b1dc55ff709b7082ea383f7aa749a
MD5 a2b86857e35d180695f3fc56f421efb9
SHA1 075240c3dbe10db71d4f846d30924e44195030c4
SHA512 33551299474dcb6e4e06e2f324a4f06a8340e3aa6071fcc83fd724712a4a404a7bf75dc68c2821b881b5bce2466a86ae2ad44dc1a2cd8f244d47509d5a3fc80b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2Mg:A3mnXoZjzyaT4aewsAjx9EaB2Mg
TLSH
T12915B023FB7090B5D23B49715B65C712EB387C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 892KB
SHA256 eb56fe14994e09f084d0a470e28e876c493b630a16f4e5ae75ced592d233235e
MD5 1ad77fff9de523b7648c856cb91151e7
SHA1 5596bcf2ebdd09054690aae1e56ca5dc2238e60a
SHA512 646cdb723060a164d08a2499a8dfbf1cc12bcdad47316bd2b1e5a455ea77142c044071ae3fa3e0dc8dafcafa0f0c878f599dc04a766539fac97ba2f28d3b9ae5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2TI:A3mnXoZjzyaT4aewsAjx9EaB2TI
TLSH
T1B015B023FBB090B5D23B49705B65C712EB397C210B6056CBE3A88A591F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 892KB
SHA256 a5a01dc621219aed3d422ab9a023f8a8ef0abd68b9fc0dc838c223f0e99bbf90
MD5 8b4a06db9825fbb5342e390f5b279206
SHA1 aa276aaca866e6986cc179941f665cb4506dea64
SHA512 ae92f1e25bc976ad2bb0e5316c5a8ece4eb243d7ed122add42f71f78cce13d6f41057384caa193afe1e069f3b53b854ec3666b06ea7591115f569fb1e71c1d88
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2po:A3mnXoZjzyaT4aewsAjx9EaB2po
TLSH
T1F215B023FBB090B5D23B49715B65C712EB387C210B6056CBE3A88A591F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 892KB
SHA256 a0f5396083eb3220673c105293c58017924fc4d5594c9997d26718b465780980
MD5 4cfe4a61c95e235f6df910a3b1e94c22
SHA1 930f1dee5fd998a6c835b26dbba7c7762e6d1ca1
SHA512 35cf5de0ee4ec2e72b16b58c6f2266798401f766313958171f59d2c3d60b469768cb36cfdb14663b955fdf3bfbf049659a1bd7b49da3df5c4475f1aa7c33e069
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2a+:A3mnXoZjzyaT4aewsAjx9EaB2a+
TLSH
T1E315B023FB7090B5C23B49715B65C712EB397C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 892KB
SHA256 9c6b42a0f83e6173dd9767fb7b97ea83c23b7b53ec9ba5ebd4889e127dc15b9f
MD5 f6e5261b3ba666baa6332047eff80554
SHA1 2880c80dba341c2b8103e9cbd5d4bba8756cde59
SHA512 1fb6e3661ef5015a7e033a7bec3f9b967647ee57f9c8128443535efdec7e54f77a6f1f23911c4a0e8ee8424a1911a054d936b467fc38d095b9a62864707f05fa
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2aQ:A3mnXoZjzyaT4aewsAjx9EaB2aQ
TLSH
T1DA15B023FBB090B5D23B49705B65C712EB787C210B6056CBE3A88A591F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 892KB
SHA256 7a5d4596833946aabae6527de410e4b020960399615b833db2cb3f33585a943f
MD5 12fa169f2ee97836e52d1172eeedb55d
SHA1 083574853de6cccafbafc44205be60bc24ebd1ed
SHA512 7ed5b34fabf796ea0716f677f2fe6fccb99fc1ec99342f053a9426736c3d44eccd9bdd2427497a67c01ef59de5df1a8150ef2aad63b0f1dcaafe85bcd38b1524
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2rX:A3mnXoZjzyaT4aewsAjx9EaB2rX
TLSH
T1E215B023FB7090B5D23B49715BA5C712EB387C210B6056CBE3A88A591F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 892KB
SHA256 57079da5940c3c32c04607272ab20678ae12255f1f9eb387d3810633be9b30c2
MD5 dcc33db026f0bb46fff12cbd424d3db2
SHA1 fa29f2a2bc364d965aa2a2680c87fac554e05af2
SHA512 68b6da24a830086888ead0e3d57e312aa0df401032479d66c82f00da88c0bb4d87c41032f0224ac1bf54b39028bdfd56abc63eb59a3efe6cbbb12ae05a46f69e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB25L:A3mnXoZjzyaT4aewsAjx9EaB25L
TLSH
T13B15B023FB7090B5C23B49715B65C712EB397C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 892KB
SHA256 a06fb8c81afe3356180dbbba8aaf4f7ff47234af026962d217cfc44dc4bf5133
MD5 a8734b5ef387d23ba95ddc7ec87d7e5f
SHA1 901e088377b1db0c40d336c03eaad1c77fb94148
SHA512 be644d3e6923e24015268db10ebf754a69dba50655bbce12448c1580640fbb353999b7ccededb691a9e31696ca0f0ad6da2a02378f981de4e23aa8a6e8c292db
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2nFC:A3mnXoZjzyaT4aewsAjx9EaB2nM
TLSH
T11F15B023FB7090B5C23B49715B65C712EB397C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 892KB
SHA256 393ddf83490d4bb1259d3c58f9ce36be4c81fef15fd631df37ee43a762b1e986
MD5 ed0d8fac39f2fc4e4b22c947cd6fcaaf
SHA1 08f78185257fdae7b66a647ecbb3f96052e5ac61
SHA512 fa11f815276428e621f840d45829e41e328dca2b5974b87b64c7bc099fefd9678ee1dcdd8df471e8eed6758f912bbf4bd761414b6f7277f57bf7fc347976e8bf
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB2Qh:A3mnXoZjzyaT4aewsAjx9EaB2Qh
TLSH
T13515B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1908-40-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1908-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3364-41-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads