9868a18785bb5b208807d7e8926b0ea522d2d77c7f4398c55b2138f23794c786

Analysis

max time kernel
115s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
Size 897KB
Sample260710-ym7cjsgs6n
SHA256 9868a18785bb5b208807d7e8926b0ea522d2d77c7f4398c55b2138f23794c786
MD5 910d12f0df8f790b163c3544cbd2d767
SHA1 d44c1c920fa788e3e9aaf7943344c6c96c89a6bd
SHA512 9e4045da492b42dd655ea1db790cabd63ebb8a88d9ed9998fff86de9c142c89acd421da80d5870c0c5f19f565359c929b9302d920f1a2a7274b3b6c48822dc37
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzF:bHuHNgHg1flT/Vk3HYwLfUjzF
TLSH
T126157C63DEA498D2D6B648B0CE968701D735BD610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/3432-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c43a-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2a3-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3432-21-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4644-22-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c3-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c85-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018979-204.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a53-211.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019845-230.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-243.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-251.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-271.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a55-404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-520.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-611.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-636.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-752.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-802.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-834.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-942.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-961.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1016.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1059.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1097.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1147.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1160.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1192.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1229.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1351.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1405.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1406.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1407.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1408.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 43 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c43a-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2a3-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c3-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c85-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000018979-204.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a53-211.dat	aspack_v212_v242
behavioral2/files/0x0004000000019845-230.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-243.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-251.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-271.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a55-404.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-489.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-520.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-611.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-636.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-752.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-802.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-834.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-942.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-961.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1016.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1059.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1097.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1147.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1160.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1185.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1192.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1229.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1338.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1351.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1382.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1389.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1403.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1405.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1406.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1407.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1408.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4644	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{4F64B9FE-D791-490C-9F74-D185F13EE27D}\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$	patcher.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3432	2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
4644	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_910d12f0df8f790b163c3544cbd2d767_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3432

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 897KB
SHA256 9868a18785bb5b208807d7e8926b0ea522d2d77c7f4398c55b2138f23794c786
MD5 910d12f0df8f790b163c3544cbd2d767
SHA1 d44c1c920fa788e3e9aaf7943344c6c96c89a6bd
SHA512 9e4045da492b42dd655ea1db790cabd63ebb8a88d9ed9998fff86de9c142c89acd421da80d5870c0c5f19f565359c929b9302d920f1a2a7274b3b6c48822dc37
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzF:bHuHNgHg1flT/Vk3HYwLfUjzF
TLSH
T126157C63DEA498D2D6B648B0CE968701D735BD610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 1df921528c265070b9c624e1dd28cd954fd8ea2a2d65b37276566c015a8db354
MD5 8f4c5c4c528847654664acfd8515e72b
SHA1 34e702dd8fa53b2b42fe21f755f3c4e48e14f24f
SHA512 e2ad8b9ddb9ced96cdc4c51f253c71d78500fa63d5feb8a2f3a4123cc9ca7f81245a8872b71e323b8822f90e800bd1be7dbcd8daa9b4cb178c1ca2ecc2a82017
SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUjzB0Le5ji0hmxNrM:T2agnTkLfUBPji0Aj
TLSH
T1D1656C26FA7486A2D0B3C4B4C9D2974AEA717D910B3086CB9294F32D6E337D15E36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 911KB
SHA256 837566a1b2a2a61b4b58afe2750682c80922dfd7bea57c1d1b5888a44184470e
MD5 17c2eb0bc06354d3b166796c801a5137
SHA1 b65bfb5bae8a4faeb7caf049f21b8d32022db68e
SHA512 e3c31084c2393edb7fb41c2fd554b99f8b9a13e38aabaaa60842e81b4de42bcedda2c4c720a7e50033fbcd542d02f5a1222b8e8219e1addab9416b61c541bf79
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzDa:bHuHNgHg1flT/Vk3HYwLfUjzDa
TLSH
T1E0157C23DEA498D2D6B64870DEA68701D775BD600B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 945KB
SHA256 bdc6dc80357c18696ff16bcbd77a0ec623590f1a84a17589687cbf03a4881986
MD5 e594c332bbd929f7512bf0f9f72cbfd4
SHA1 094dc49744656cfe364c788469ebb824bcd97480
SHA512 6fee802fdf5213330bfef424f8e390d935c5969b0b670bb695252e4193ab3d9ee9c90ee44a2cdacefdb888d511dc17e9b1d55816227d4c9eebf20678c159f463
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzQb:bHuHNgHg1flT/Vk3HYwLfUjzQb
TLSH
T15B258D23DEA458D2D6B64970DEA6C701D735BE610B2193DFD2A4B31A9E333D02E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 920KB
SHA256 5772cd5f8c9c307b28f1d2bc23fcbfbe22b371af93c78ab44376a3c1d894cf55
MD5 6ad9f0860e89a4823c40a1b0b38eb63e
SHA1 c01454b976f0a520e719377ed56af83cfe52fe74
SHA512 e5d7d67b80420c4ecb62a44d97bb54e2d0b08ce968638bb63f11c2d0af07f5f0466557259ab0227f1c2af2b86743dd80e4a522f649b2c07901adaefbb063a6fc
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzLZ:bHuHNgHg1flT/Vk3HYwLfUjzLZ
TLSH
T155158D23DEA498D2D6B648B0DE968701D735BD610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 920KB
SHA256 99ae130ecddc8eb1384bc47b1fe9bab2697411ddb854f02a4316b1f010e4a880
MD5 e9ddc28b5b05e31fbec8f34c03eda2da
SHA1 f4eb55885fe6afff5c86227b5e573f230ccf4110
SHA512 4ae0c11cfa3fa8d92065b7a5c8afa1dc67a22542e422c45d78558b7a9aacd091e166ca5a2e310f871cdfca2ab3aa62d3c642aa1e7c5b894b4e329232ddcc7d33
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzw1:bHuHNgHg1flT/Vk3HYwLfUjzw1
TLSH
T13D158D23DEA498D2D6B64870DE968701D735BD610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 920KB
SHA256 6d94603cf10ded7b62aa727f22ef3e958a1f1046de740fbabb27e249aac12adc
MD5 77072e465197e168a36581382d5e757f
SHA1 513e891f33ed1eb332cc16fb824712e949fdd8a5
SHA512 f2f7c2b319609cc2b43cde65d3b227242fbb19598fe31ac0eb18e7362adcbb2504fa3bdb6c0f759c3ec8e1fab36dea55c37baeff333bf62951cfa7e92af65b8d
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzi6:bHuHNgHg1flT/Vk3HYwLfUjzi6
TLSH
T1E5158D23DEA498D2D6B648B0DE968701D735BD610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 920KB
SHA256 909583dd66cc8b1718565103e4a5b327e427e1a3f6b1eaab2624bb496959cf30
MD5 deae81bb644919ed0f0d788a4ccbc60a
SHA1 943454af13aed71d9953778029561a853c74fa90
SHA512 3aaed0e88a7b83048c8f3677e2e5d496fe39aedd06521bceb0b019f21ed9cb43c039779ad4ff5d95e3c94c001ab1bb118f794578add372218ffd83e7a212be24
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZz6N:bHuHNgHg1flT/Vk3HYwLfUjz6N
TLSH
T14C158D23DEA498D2D6A64870DE968701D735BE610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 920KB
SHA256 f66a5acff5cdc1b9394b26f155640bf9c295f3a59321485431ed66248091c600
MD5 473589960ded92a7b395e5b3ee0f4426
SHA1 7fade3dfe08ce26befef9f223b34d02c5e3d3251
SHA512 1e26c83680752cbd13ce431009266fe301c1214ab60701cd4e809efda8cf6e8f1e5e0bfec19f681cc36182043cf1fb8c6d59a94777dc7ddb477abb0e7a053ad0
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzgf:bHuHNgHg1flT/Vk3HYwLfUjzgf
TLSH
T1F8158D23DEA498D2D6A648B0DE968701D735BE610B1193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 920KB
SHA256 ca0307cfacc4ace6519f036f9b9a53b8b0d72a62b2e88ffa71531e98e28fa081
MD5 deb6a1e997f02d98dd99403dc30d6739
SHA1 57a83343bbc11775c16c35ac018f6c7e25811b52
SHA512 a4cb8bf6c635cf1a26557a5607e5ef73da18f6e639cdf9c18b5a118c37a3838692c28ff8d4ce2eef00d745b5ab07e51be88f6af1a86c10763f2ed7753042d61e
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZz6o:bHuHNgHg1flT/Vk3HYwLfUjz6o
TLSH
T1C0158D23DEA498D2D6A648B0DE968701D735BD610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 920KB
SHA256 d0da2c4f9309d51ed07de1cece539ad0575d5f76b88ef3f93e57117fb30a799b
MD5 d66477e403aa31b934dcec6b5b26b4aa
SHA1 532b13ee934cb06fc0bd3dc632081807653a3759
SHA512 b2c069f9f23c9195b6340524e476fa605040effc808004da6a33fcb0aa3c0bda875a70037e59c9b239d68bbf963166b2b21be8c444760a3b728a5b64cd9c8f04
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzOu:bHuHNgHg1flT/Vk3HYwLfUjzOu
TLSH
T19B158D23DEA498D2D6A648B0DE968701D735BD610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 920KB
SHA256 7d9255fdf6c841bd5df264ab9f9ad5f8dbf3ce2987812139f7d90590dcdb571a
MD5 5d98ca2e2299d1249f5d307d35570c70
SHA1 beaaf45aca3a4c3950c705b673427717f9854463
SHA512 471d2a9560011946ed5f79478acc8ebe8a25336daa4f2b9bdcfa249dd73b4a4a85831097a0d0a1963c6dfef709877d03a1eb912103909641b15c9adcd5497fae
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzC9:bHuHNgHg1flT/Vk3HYwLfUjzC9
TLSH
T1C2158D23DEA498D2D6A648B0DE968701D735BD610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 920KB
SHA256 509c80abf9fb3aa5283270bdb140160fa2be0da94ae51d236be196895f58d7db
MD5 116b1e6fd97fcbfb724117aa53035935
SHA1 ab1e61b5ca3aa152964ac573e11f2d606883e29a
SHA512 d4de6928be43b29325b7759c67eb6d9ac47784ea4a2cbb1c16393fc3ef5aa9bc44e5e96c1791f1ee696711118220e08cd7da3c8070a8144429b9781eb1ca9593
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzCc:bHuHNgHg1flT/Vk3HYwLfUjzCc
TLSH
T17C158D23DEA498D2D6B648B0DE968701D735BD610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 920KB
SHA256 134c51c8f51ab00fbae621b375208e623fd1adac407f87569b6a88386a62cc8d
MD5 20f929feb48e78b8ca095b6dbfd40945
SHA1 71f130acd93e58657d8bb7bb3870a7c2af6b8dce
SHA512 829ad731dbfe2e78190b8a8864702e64935b20d473b99d7bf13b6cbef49948e79b52c1b7581f9c4b4214aa5da84d6930d25e14ce1e22798f546b4296d45f36b0
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzLp:bHuHNgHg1flT/Vk3HYwLfUjzLp
TLSH
T1CE158D23DEA498D2D6A64870DE968701D735BD610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 920KB
SHA256 0e555edc5e46584075371f2ed0c76a7520748ee3be9b0c2e6b8b81e689aff6c6
MD5 32262d225240b35a31d6ff81b729398b
SHA1 fef820b0239f816746c7318523423b9bc0e3e9b3
SHA512 fe8788b899f5fda9d519620df3f570046e33cb4069085fb6f42fbffae1ff737be7762c471ccf8755963d5a6e86e0feb63a1905c296191e7d08e32543627a8269
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzc0a:bHuHNgHg1flT/Vk3HYwLfUjzcN
TLSH
T10A158D23DEA498D2D6A648B0DE968701D735BD610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 920KB
SHA256 5b3990b9bfbb43d0303f926d8234d206bb262521781b5f5727e754287d8461b5
MD5 e9e15c3a52fd39d243c53b9b1ba8b661
SHA1 c35a3b50fd364b0e56f45b38bce138f75129b62b
SHA512 971378a87093d4d78562d6fcf9dce89422f9cf2f9acc512549de6847917ff7a1d592e41d6c5a2ef381cd608d303305d83f5c951b07307ffd68da0256f3826b13
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzEF:bHuHNgHg1flT/Vk3HYwLfUjzEF
TLSH
T191158D23DEA498D2D6A648B0DE968701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 920KB
SHA256 306de5f3e302cf7029d029824d922cc2f42e7e1ad6ad253d163a92dd6be25264
MD5 de95df81dce9a83815e692392a836da7
SHA1 42dce44415d311259eeef2c04ea2bcbc5d95cfd2
SHA512 60f3236844ad44ac21393b4d20f57908ed1c6e3a9a124e3f714550b3c6749fcd8ba6c1b38c9a3921b5ffcaa4e5d788090ecb052149bd6a624805e2dcabf43bee
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzhC:bHuHNgHg1flT/Vk3HYwLfUjzhC
TLSH
T16E158D23DEA498D2D6A648B0DE968701D775BE610B1193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 920KB
SHA256 210b024bd6c94a07d0ec0724690d120a873cdfc233eab4cd7625076447dec4a3
MD5 a7d1fa921895e6f62f657598823f558a
SHA1 2b7e7d1e29e70adc2c635beb7f4c697a98bfebd3
SHA512 81125d54b9d288d850ee191f747f6805fc8c57defc98ab21e43c3ff44ac47b7c3ccfdd799b450cfafcc80a6a5f0d10c3b4a4d355e768d49eaa9e4bd6832e0464
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZziw:bHuHNgHg1flT/Vk3HYwLfUjziw
TLSH
T162158D23DEA498D2D6A648B0DE968701D735BD610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 920KB
SHA256 dc27aebeda515eddf3a7ac31dc175eabd597372e9ba7d28cef36554bc0092edf
MD5 ba27c184d4d88a0e47cbd4d483a7b600
SHA1 b4c8bb5f96fb7508c8bb394e5ff3b8b18d780b1d
SHA512 f6c93b38afba5088512dbced3baeaf6f194c16c850bc6777f4c68a5126db04ab0693da678159f5ade4639e2cd49fa5993fa3226f9318ce0f1b1b01d0cf25c90a
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzpT:bHuHNgHg1flT/Vk3HYwLfUjzpT
TLSH
T129158D23DEA498D2D6A648B0DE968701D735BD610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 920KB
SHA256 20390cce4102b274859feb85639faf289739f1f9f9380f98badcdf3f09d25931
MD5 0ab970d16e2374180d905e4be473931a
SHA1 75084ede9ff7eece90079578729a625f556012e0
SHA512 ad7912145b6417a3968bb7f81532226a8fe304fc046295fa12d360a2e8d9869d8eefb695f793246a318ad445e2eeb8dd80ff62ab25852e620921b41f7a194ef8
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzHu:bHuHNgHg1flT/Vk3HYwLfUjzHu
TLSH
T15F158D23DEA498D2D6A648B0DE968701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 920KB
SHA256 2304e7e7bb2b56ec657e272f89657b86d82d7ab6c6cc2829127608fdf91f404a
MD5 8d2fb4fd091277227579c1724c6abd15
SHA1 6ff34d41a89a37b956d97d7249c59594cd305c2b
SHA512 b10d8d8ed8619c047785a209d885ea958c2a6da7646fb50252127e981c7d4591c7bf0e8572b9be8fea4fa93f399fffad50988b47c1c86baa7ac091d7a062d939
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzbb:bHuHNgHg1flT/Vk3HYwLfUjzbb
TLSH
T1F6158D23DEA498D2D6A648B0DE968701D735BD610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 920KB
SHA256 adc94777dbf679ff5c5b69490601220258de0207921b4488b3d6a19cfd94cb09
MD5 6cead64661a38a407ea6638d9fbb4c28
SHA1 00034ff0036ac7c620b09a80a3533c0ac4f9fced
SHA512 951048eb0f7534e2a76f5ef472120f0dd2f0ab375ad6032ace3dba3eee8d49d13bde14d4dd6b0f7a17c461e2e31221dde6d2e4611f493673618f1bffe50ae409
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzvf:bHuHNgHg1flT/Vk3HYwLfUjzvf
TLSH
T13A158D23DEA498D2D6A64870DE968701D735BE610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 920KB
SHA256 275be5b87cfb0694c1b379dab0782c89555265cdf0347daf58818741502e8c8c
MD5 bfbbff8f32df725327f6ff377d180556
SHA1 2034df8080e51b4ee6bdd902cf5282f8490b490a
SHA512 ebfad759a290fc0451d3b655f57ae487ac2a6bab962413f6c2d424b15d406f4ae44010d81530098cd29872544c602827391d8f7f492575da3bc2a3d4923593eb
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZz4K:bHuHNgHg1flT/Vk3HYwLfUjz4K
TLSH
T138158D23DEA498D2D6B648B0DE968701D775BD610B2193DFD2A4B31A9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 920KB
SHA256 be160e4585885754e203a10830cac448b47b25b1944dba0aa4aa978cd6140125
MD5 6d5a171f3e2863da2881f8347fe11304
SHA1 e326ee82abdf80b30e540fdd7484fd7f5568d3b8
SHA512 ff026cebf3f6b79f041b475198e8c9a1e532249361d30ab76f6d60b77addeff5ecc03c0255768b87f1a406178fccb165c44a7969677dc0a539e3eee7210505d5
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzlk:bHuHNgHg1flT/Vk3HYwLfUjzlk
TLSH
T187158D23DEA498D2D6B648B0DE968701D735BD610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 920KB
SHA256 6f25730bca8edb88d799fc77cee18239924affa289d782d67e2968adc2b34966
MD5 a128caa4959cf56e45fd552898d3d0f6
SHA1 01b03a8833a3084448acd0c10cd4952160f0a6c2
SHA512 5d551c16c1fedd8276ccce053145a26cff1c370a3693404c63b42ccc6853ba7d2381452104cea5cf099a009a6adfbab738d55c6fa81144aa2fd620903782ac9d
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZz60:bHuHNgHg1flT/Vk3HYwLfUjz60
TLSH
T17C158D23DEA498D2D6B64870DE968701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 920KB
SHA256 03558457036e42e5ad56129e2efcb90be2473b626cc9cd9c083718c30f524590
MD5 1aa180177844539c0ac331d473d2d3d0
SHA1 4a7997f638cab7e5ed2a0573a1c9939d4cb6d976
SHA512 afaaf038733f19cec4f32c96c848157fe6d3ff0557619d298091692580d8635f7b74e5fc1611aafb0456759baf65331f29de23795ef7dd0d82de5e257b7ffa31
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzp70:bHuHNgHg1flT/Vk3HYwLfUjzpg
TLSH
T1CD158D23DEA498D2D6B64870DE968701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 920KB
SHA256 ebdec97fcdcfe766ee76179a2b1cd0159495bb616b78ae322b3e852830f6c833
MD5 f4e3e26a0df2e728aedfddd2b1695dcf
SHA1 5d3f5f84db6bf366e2e692e1ff4ec148946893a7
SHA512 5a750f1f418349a69fe4d59c3f641cd8e6012e21afe6cdb5b76fbe1a55504493d018a57bf8c2a1181de8aa11661b25869f338737fe996639a54b21bffed2d71d
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzQr:bHuHNgHg1flT/Vk3HYwLfUjzQr
TLSH
T1C6158D23DEA498D2D6A648B0DE968701D735BD610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 920KB
SHA256 5cf00fe3c4f7de6ae857669176d7f299293a7982d5ba987f8a32add48bafbe38
MD5 f17b734ce64868e189af449db1e7cb47
SHA1 3091bcfc0484370abf9cdf71f5753d1582cd8812
SHA512 0b32f18cdcd8dd5acf87255ad7f4b3efc6cd6f6795bf0e6d4cc5131b6d62fae5d9c6d33ecbc1fe98f64c83c9704db18f31985f10488ccab753a13c589275a815
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzOn:bHuHNgHg1flT/Vk3HYwLfUjzOn
TLSH
T183158D23DEA498D2D6A648B0DE968701D735BD610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 920KB
SHA256 6e658fc77a15bda4cb47722e6e3db1aa4ac8763ebbccd6d0447cda78941f33fc
MD5 eb6dbd9e1a4d8982d774e6d1f8d38933
SHA1 388bc21f3e41025251fa843884cbe49f268b6a94
SHA512 0dc27fbde9e435d833c5809b79a98675766e6704022e121adbc822d9695362daff08c76190a46941f15a1e21ea738944e6a197265c946745360f6e812454a57e
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzEx:bHuHNgHg1flT/Vk3HYwLfUjzEx
TLSH
T16A158D23DEA498D2D6A648B0DE968701D735BD610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 920KB
SHA256 3b7deaf886820bb87b60cfa26b0200c7bb2340aa430aeee513ccb3b7f4d605e7
MD5 c40adaa4a1c366b401953a2457c63080
SHA1 247214a5017a80159a2e492f5668d6b12b540b3c
SHA512 e1d96b078a16bf1154c67d06ebc0433447a9405db7b40b65e79c21e474f2665cc873b042cdb28efe3920082b14f20c803fe55eabf7316b79f1e2ee54f5ce9b42
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzOA:bHuHNgHg1flT/Vk3HYwLfUjzOA
TLSH
T178158D23DEA498D2D6B648B0DE968701D735BD610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 920KB
SHA256 0cd01e8d93108f22aa03a8de87a54afd6d08ead5a86f1ae6f44ccf265d09805e
MD5 06f3888243b4af304de2f52d362945df
SHA1 52941210664a7e24757aed2fe87d16e3f079dcd8
SHA512 0c717a65eb3452b175a83416f7091efe44445b98fdaee173c3717f049687169a66010fecca37d6c7cf5f4d67b67f9eadd70c674d296d3a62aab7319f2555bbd2
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzH9Q:bHuHNgHg1flT/Vk3HYwLfUjzH9Q
TLSH
T185158D23DEA498D2D6A648B0DE968701D735BE610B1193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 920KB
SHA256 bfe756c04c1737d14521b1e199076e999c43dd6ecac525344d08465083ec6ad8
MD5 a1314110177a7e463ba00fc1eea75bfd
SHA1 f1fb5dab3a5f8355d8d0271d945deb79e3ae6ef7
SHA512 f06c8c2eb14ed0c992d22f2a4762e0a701b73ae11daf2a03a7cfab21aad8fa384fb0482dc8847d6e155ae70af576fdb805e7082e7eef24f81551fc2c1ec75077
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzO4:bHuHNgHg1flT/Vk3HYwLfUjzO4
TLSH
T177158D23DEA498D2D6A648B0DE968701D735BD610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 920KB
SHA256 955610dfb9e7f49b477f97456d28bbb19ab928b17092b20196f4256218d6bc1e
MD5 89448e3b696d75547c3203b19600fc47
SHA1 98ee4b2b39ac538f02f31dcf36b0d47a6fdc25d8
SHA512 4e72063248f01e19f3c08e41f633ecf3fb6780865dffa87ff200266ac3821f2fddd32d1a7361f1883de68100ee7a1fcbc94afc2ffbbfa6d55867e7c8a2d6b480
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZztu:bHuHNgHg1flT/Vk3HYwLfUjztu
TLSH
T1AC158D23DEA498D2D6B648B0DE968701D735BD610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 920KB
SHA256 f77ea9157b6dab4a92ef20e7718f3136041b885d3624a5b5151360b91d8dd175
MD5 8fcdf4c89f1fd0c70563fc5341e773c0
SHA1 179b2b93f452101f018f4030c2778b17cba4f5de
SHA512 bcf196b51d791973dc5372d1e52407623edd7920a72c97c1f4532fcaec756acd106571b5c74f27ce9c973c44debe878c8ab189b99cb21d013150e0032dc0eed6
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzgj:bHuHNgHg1flT/Vk3HYwLfUjzgj
TLSH
T121158D23DEA498D2D6A648B0DE968701D735BD610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 920KB
SHA256 c7c4aa8aa10836e3f471ed6779563b68199740648a9103b619bd990bd43240c7
MD5 f70614975345f70bae59ae034d41142f
SHA1 5df793a85da03f6d72efaa7a6490b52d12242c33
SHA512 9969114fde510662685eef1c1aea817214fabdd05fa7274e8851d4fa97eee16512fe93f3d11e02650a5d0f611f4d76d85f305a832189de900baac6bdb9dbd6bc
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzRg:bHuHNgHg1flT/Vk3HYwLfUjzRg
TLSH
T183158D23DEA498D2D6A648B0DE968701D735BD610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 920KB
SHA256 37d44155a78d5770d29e9779740558c21b32d2ffd1b63c7c7e6511ee10b75bf7
MD5 6cff710e0f5b259802a1ef237515c35a
SHA1 c2be62769e93421b3f0926a37b33e02c0e1b84a4
SHA512 82382c50b266971e948f889f45fdc12e25c7bb097a54c1afc43e4e62155e87344e77d669d3166df8b327945daa012a47ea7d4b5d370082bcf8f62872ff474366
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzII:bHuHNgHg1flT/Vk3HYwLfUjzII
TLSH
T102158D23DEA498D2D6B648B0DE968701D735BD610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 920KB
SHA256 7809a804161c117a07f9fb112745f69348f06373d39e0873ce927046b4209658
MD5 62fecb1a2f9ef6636584a1894610b114
SHA1 ad7bba1c3bd03d40d34092143922db5cfa838308
SHA512 d2d2d3ff81064a65c77d185001f37608e8d1858b39c711dae07ad33e1424a628235c7019934e5f703c1cd4debffdbd502482f712c6f1af6568d862dedfa9309b
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzqo:bHuHNgHg1flT/Vk3HYwLfUjzqo
TLSH
T16C158D23DEA498D2D6B64870DE968701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 920KB
SHA256 2944cae44334ee5329e57e4cfaf4cdf8b74af5058e1f2e605a09c35f93408b6d
MD5 766e9c238965705dafd9ac3ad3386b34
SHA1 4a16242d1575717af62ab7b46928136fc8f5bbb4
SHA512 1c7be0401515a7d83dea85dac75178ce14f0cba89209db459b55f24ac03051136651b2b89527dcb7d30bac77c0ed4b6f3a7b6d550de8bf5a5389b1df10c87446
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzB+:bHuHNgHg1flT/Vk3HYwLfUjzB+
TLSH
T116158D23DEA498D2D6B64870DE968701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 920KB
SHA256 5cf5218b93ead892506818ef668dfc69b6a7da45d7e22a26c37b8142e2191db0
MD5 6a1a0f6a5d52c5e48391f17a54654a27
SHA1 5a05dcbb36f5e5fd60f476b22dae5f271ef9f81b
SHA512 3622a370d72936c55479b266f1b6e643286212739878ee45862cc9d4fa58e0a5882c71127f4f8beeda7f61fec21800d1fc965b88d47da2ff4205c50983081a51
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzPQ:bHuHNgHg1flT/Vk3HYwLfUjzPQ
TLSH
T16D158D23DEA498D2D6A648B0DE968701D735BD610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 920KB
SHA256 9bca4e1cd445e48744425f79e30e9c04e540ee3997fbed746d7289008a89db5a
MD5 883d7968faaf99bf9b7935f78e914128
SHA1 b34d4806e074afee717000abf625c09a658e47ba
SHA512 569a8868bfa0427782d0ff49b1fa094a5f0d3ff861a526b092a6567315faefeae72bd4b115af506d79cd9dcdf71fe6d31c3781e851fc6267b31945fa0c200557
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzUX:bHuHNgHg1flT/Vk3HYwLfUjzUX
TLSH
T174158D23DEA498D2D6B648B0DE968701D735BD610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 920KB
SHA256 9849bffc9b309e6198f4381605e6d7867feaf22d09de6fe48db1ea537a3a86a7
MD5 ca51676db320cf794a098c319dfb5f59
SHA1 791aa8486810480793904024bb353169194bc429
SHA512 7135125565dcb4df84e3461fd0da3ea7ab3ed8682343246343ec8114d3d8c4e68884310cf3c853dcae1fe7cbbe770e01e3b5b90841525702a749b1757ae18761
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzyL:bHuHNgHg1flT/Vk3HYwLfUjzyL
TLSH
T15A158D23DEA498D2D6A648B0DE968701D735BD610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 920KB
SHA256 438bc6f601571402a7ef5a7d672ff66be8658e320864ca4ef7856b365a45e609
MD5 d104b49aca5ff19f74b24110350bed68
SHA1 5312b46a1ecd033de7c65860a646969e69bb15e5
SHA512 6ab72bae65c7972daaa7ace73d4eb9a57c70fc99cf26581e48edf1ff846e08ef6871658c578cadcacb45049326f47cc91a1f29e2f68b880d31d8b11ba9410465
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzWFC:bHuHNgHg1flT/Vk3HYwLfUjzWM
TLSH
T119158D23DEA498D2D6B64870DE968701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 920KB
SHA256 df74f43bcbd41f50e3a4ddf7938bdefd418782c2e04817d9fd60592c0a68718c
MD5 b0f7b138c745aad3b986b66613f9f5fb
SHA1 a4b8baca36d8038c7bd9d4eb184211188343247a
SHA512 a6474b4d63ca82dbb44dfc212e36907003783481c453d9398c2759289747911e054c2fd16e1600c14293ee6e3b2e6c7089bdba4fb33b2f36cfac889fd2d239f4
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZzfh:bHuHNgHg1flT/Vk3HYwLfUjzfh
TLSH
T123158D23DEA498D2D6A648B0DE968701D735BD610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3432-21-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3432-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4644-22-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads