4c7e24d2853dc7fb3f31548d42c7684dbccaac568784c853fc62b0f3f454a616

Analysis

max time kernel
103s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
Size 941KB
Sample260713-2ssccsct21
SHA256 4c7e24d2853dc7fb3f31548d42c7684dbccaac568784c853fc62b0f3f454a616
MD5 37480352ef142c6ee690308b0dde8e13
SHA1 c18642cabbe7a77761d72bc133382c8dab88c342
SHA512 cab8d34d24d3b3e5d4446269de0034a3953e0504a3bf9e67f1de390528092318242a548e8c3f42894e837cddacfe618baa80ce90050f071a5c109f57cddccf9c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUx5:A3mnXoZjzyaEFo3+aWii0CJBSU7
TLSH
T117253827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23E1F236D05EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 42 IoCs

resource	yara_rule
behavioral2/memory/3052-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c4ae-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3052-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3144-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-223.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001babd-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-441.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-582.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-620.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-681.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-736.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-981.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1073.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1128.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1147.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1346.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001bac3-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 39 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c4ae-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-223.dat	aspack_v212_v242
behavioral2/files/0x000400000001babd-260.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-441.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-497.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-582.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-620.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-681.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-736.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-785.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-822.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-853.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-872.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-892.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-906.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-919.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-950.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-981.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1042.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1073.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1128.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1147.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1173.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1181.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1218.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1327.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1346.dat	aspack_v212_v242
behavioral2/files/0x000300000001bac3-1371.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3144	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3052	2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
3144	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_37480352ef142c6ee690308b0dde8e13_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3052

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 941KB
SHA256 4c7e24d2853dc7fb3f31548d42c7684dbccaac568784c853fc62b0f3f454a616
MD5 37480352ef142c6ee690308b0dde8e13
SHA1 c18642cabbe7a77761d72bc133382c8dab88c342
SHA512 cab8d34d24d3b3e5d4446269de0034a3953e0504a3bf9e67f1de390528092318242a548e8c3f42894e837cddacfe618baa80ce90050f071a5c109f57cddccf9c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUx5:A3mnXoZjzyaEFo3+aWii0CJBSU7
TLSH
T117253827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23E1F236D05EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 b41cc00934cd3a0076a399decb6c928f8b63788f0798774105d1988b4d317702
MD5 f1486904f36ff741571c2df73c617cc1
SHA1 6eaaf8253c893dddf917f0bba8a4d66d5121f6f6
SHA512 0b4e27fc289a42bd0ee80364f06248d382e1638374c81a5cddb7b1dfa6268f73445ec22c84977d0504b22699764985b004924b572c3776cbbca278ec64972b95
SSDEEP 24576:A3mnXoZjzyaEFo3+aWii0CJBSUn0Le5ji0hmxNrM:A3kMIJBSUnPji0Aj
TLSH
T17E653927EA6446A1D07EC079C7929646FB7338510BF086CB52D4D23D2F236D19EBA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 964KB
SHA256 505d0c630219616dd6126aa2138ffc9de587be4fb55c1331fd0f1cf8bb43b3aa
MD5 f1cb01e883b01e6a3b0f278de1b5b177
SHA1 3793458f5a5df79a038a7c08f36513a041d33948
SHA512 e2cfa0c4576a002025be6a134210f55bddd122d9cd5b3cf49672a41c3176887306679d62b5f1494305018816811baa2da28080743169fb643bf6c05366b4fbd9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxG6:A3mnXoZjzyaEFo3+aWii0CJBSUw6
TLSH
T134254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 964KB
SHA256 bda5db3728e2b3202864008f12357e08e44cf3d04a1598cc4e89f62c5542b9a2
MD5 8668640eeb7b898a8035a23684858247
SHA1 80a8614239593e5a1dfcac19ed3dca6aafff4282
SHA512 4e37812fd493846bcc07222a3b3601e88cd1223b00e3180121b7ef4332d58db7cbae3b884648b284bd00906b099109839a7b14e2d255b79dc9d33341ce2196a4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxWN:A3mnXoZjzyaEFo3+aWii0CJBSU0N
TLSH
T116254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 964KB
SHA256 16384875a61fc40befd810e305338bb47ad1cc27345f11a0b958b97c0d7fd0f8
MD5 6ef8e1ba6a88c94b1f049ae2220a3a76
SHA1 464fa654af95902155f11ca7899feb0314572d0d
SHA512 7b6906093a79f716473f2b04554567e61f812daf0f46c7e704f919afcb4715672d91f1661b599f3d4dde0b46e6dbec07e344491ad2a213ce7b1412dd36abad48
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxUf:A3mnXoZjzyaEFo3+aWii0CJBSUaf
TLSH
T18B254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 964KB
SHA256 8bc633e423a37d47545570d61a9d114055fd42cf11b4f69a04ade07420c149ab
MD5 2a81293243ec97befb8ffa8bac37c1ad
SHA1 3d5cff6b9ede9ee3ca67551ce82845f97712d57e
SHA512 7454593e06bf02ae877822179094051185d3bbca3fbd7db0df57c01113237e1b5c617af3c5a90e3df4ec08f32888c9f7e04e53ced8d173eefbd071105ff3f911
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUx+o:A3mnXoZjzyaEFo3+aWii0CJBSUUo
TLSH
T1E7254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 964KB
SHA256 6cd673238fadd78771d29bc96658a2b979eda68f94db8c14f05be2ef66fa38bf
MD5 6c19a9d9bb5f072060daeea4e80eb146
SHA1 a14bea23a21a8448159757f25827d5a3d48dd923
SHA512 2a42be74ddee1eaed252a4e0279f20601c52279a08fac7c6ad66c0912eac946665059563ba2fcec2afabc1a4eba5ae489a005fc24651debd88f64764fa07ec91
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxSu:A3mnXoZjzyaEFo3+aWii0CJBSU0u
TLSH
T105254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 964KB
SHA256 892026c95c2070a2586fee176691fd17df5bb320629bd871c99eba687bf1b0e9
MD5 9ec80107d9ee308756d00562e1396373
SHA1 bc4961a63b3452ad4c495e94f296d8c6e28f93d7
SHA512 a5742226e89acce35addee8785d771ed3e996c2e8d179f1d6ea2d8ae46016da0826606140e3759b3b355543bfc48fadaff855ce8b809ffce24da9ab04224cf5a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxm9:A3mnXoZjzyaEFo3+aWii0CJBSUY9
TLSH
T1C4254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 964KB
SHA256 3bffc2db68f11325ec42c9c0e6693e669bb6ef17b26dbc9638d5c86137d9fe3b
MD5 8d881faedd504b6ca51bc5565ecff978
SHA1 82f3d42901cca3c3013ee99bffdcbbc9835bb844
SHA512 9d89072f94f0d34da3d64256ed41faf10c4abaf323f29c695a6932918c3fc1d48db18f1f2076671e2eb2ff51e293aec3f8909fe16d3571627be418b7670386d0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxmc:A3mnXoZjzyaEFo3+aWii0CJBSUAc
TLSH
T12D254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 964KB
SHA256 17330dc3c5028c5b96b66dc556c2224374b8e40c80f81eb345133edd56a19f8d
MD5 6c56ac3c4504de1900a35d8ad0a5c374
SHA1 f8ddc5fe03d2ba41811c2300188bc611886b79b5
SHA512 0e4c9a1be4d11f626a278dccafeaf5a9b06328b803c38ba448f5920eed5fe4b6f969f6136fabf335934b595fc5c6377af39721ba807d13b2b439cb0ab8d59ba0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxfp:A3mnXoZjzyaEFo3+aWii0CJBSUpp
TLSH
T171254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 964KB
SHA256 08f7ab93d55d2a843ff189f095cf351b998420d072d8ea3cd1920ee20f3fe6cc
MD5 a1077b390194d2fad9875fd05c1aff88
SHA1 9d7045e17fa33e327dafd69931fb40723b447111
SHA512 5293d8a07904f7088445395494162eaad18d3cb5e9d61dc112b13209d7beafe6c8bb5456a7bed0e9757f5aeae878b43303cd84e08ad47decd346ec24b3ca417e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxA0a:A3mnXoZjzyaEFo3+aWii0CJBSUuN
TLSH
T188254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 964KB
SHA256 0bb40db78220f05465bbc8e3182062acea7d5ffe406c646897e1f7521554281e
MD5 b1a4c8367d24b76ac6a9701f4f4c5958
SHA1 b45b0a94a4e088547317f5442dfc3051ac8a0443
SHA512 6650650e7ae79106f421506c62d433dbfa3f33c56e2d6cd878f2bf41f0b521a029656ca466ac0cdf03c6e95830fc0fe4643cd51e15f9154801611ce79e0e6a5c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxIF:A3mnXoZjzyaEFo3+aWii0CJBSUSF
TLSH
T17F254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 964KB
SHA256 eb6a3b2b77ded6f3437c2944b6056b29d413c8b0165bc36b6132f4a0d7e68c2d
MD5 ea07188a17bc94f715a226bc99201e26
SHA1 2b2ee6c29c8985455aaf1d9c5d24eccc7fa1819f
SHA512 f1496aa06973245c065aa8bc61532a72ff43f5a68261568215ccbef6384f0485d967f1093c5b20ce2e67cee8129ecf69ce44e8014a07087ce6bfcf4e9c56b1b7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUx9C:A3mnXoZjzyaEFo3+aWii0CJBSUXC
TLSH
T140254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 964KB
SHA256 09ed1b5833b340bc1b118edc41fa71f9d30fe5330b3bfc0fbb1334bc95aa1ea6
MD5 cd95ddf0778ae86a3e8005a7af1d5895
SHA1 1217ec2ce5d1b42471d1c85c47b21112dfa4fee7
SHA512 b5d366276bb0b8b83a2eb10e8b4ccc43ee07c702c11f647c7759ff5acc7deaf07291de06b9504f130c8e50fa35c744073194f47884f09f32b93a6ba5318a4a49
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxGw:A3mnXoZjzyaEFo3+aWii0CJBSUYw
TLSH
T1FA254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 964KB
SHA256 451cc3b50281ccea30089d8f4628d0960767cb0455ab927b51ec06ac8067cecc
MD5 302ca934de555b46d9eed1c271b4c42d
SHA1 c8c8142110b5080fe51dc8c4331510a36df7f638
SHA512 ea6edff1c6d4ef0310f0a47c96c612a970261f44aa6bd25ed741054869871a784386d8273831ce6057a46264f36ce677b188841f8c4c9146d556309f0099208b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUx1T:A3mnXoZjzyaEFo3+aWii0CJBSU3T
TLSH
T17E254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 964KB
SHA256 e8b33ca7e90743ae988a992d17cf8b6d056d4fa3f05e6f3989941906ddbd339e
MD5 f846196369d17e59d4455db7cace74c4
SHA1 b2d9d94a25df54699a1b5795620b41ebb2b2f8ac
SHA512 760d41d089ddd2c8c055e4a1b2bf5efa8fa132b239d4fd1244870b0c8575d77e2586889ea7148f8eb0412d03e93064ae6a39463a5b9b3bb1900cff8dc67cbe1d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxLu:A3mnXoZjzyaEFo3+aWii0CJBSUBu
TLSH
T19B254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 964KB
SHA256 52c2d814477345693fa6784ccbd5d8667999bfca299d663d35c4c7f0fb6f9af6
MD5 3e176b95bc0897997696fd2d2311d5c8
SHA1 693f55d174c63ba79bf472b798abdab7b40c7197
SHA512 b1adf8a9f91e5abb2a581842a9260d39340925221ced9805e5597928a06ba461e16ed8a7f91438952e09a98981cdf994545adb08cd6259df73acd7452bb82acb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxvb:A3mnXoZjzyaEFo3+aWii0CJBSUpb
TLSH
T1AE254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 964KB
SHA256 67a4dc410305da46f22ab5f40fc3f34ee86322b89e4fb52ee65fb4346e20f3f7
MD5 227a7474f6abc24729565ca29d5cd5bf
SHA1 9c5ad9545e7798eaca840a5a583f3a45ba7688bc
SHA512 a9f172e69ba587bcc8e422a3e916de182c93bc524450f693278638de59e0d1b6d0d85a31e44446e5320e768ca7aa9132db9f024e97c06e6b47f3a579c936cb35
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxrf:A3mnXoZjzyaEFo3+aWii0CJBSURf
TLSH
T10A254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 964KB
SHA256 65c848ee0cf5cb1d71d12ea5db2f5d4ba153f1444498ac380bffae594233bb18
MD5 fcc91af77c58a1c56811d2e7b9a6cf5a
SHA1 d307e08a000018c874da6e330b666b9687a9b7cf
SHA512 c81542d754931df56922c1266035db62e07859bfd0611e460dc24f5cba24cfb46fa1f709b76384507fab05d43fea5387e06319b6e73aaee94642f0fd0f8fedb3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxkK:A3mnXoZjzyaEFo3+aWii0CJBSU6K
TLSH
T1C1254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 964KB
SHA256 1d12a224cf16068b50f53c0d0676e7fd3f42ce13cfa20fa7b3e3a3a24e72a64b
MD5 f819ab11bb528f56c1d2ae069da43360
SHA1 d1893d2ae26cc34bc0aef284bfe23eb59412d772
SHA512 58e15e577393e87fb08ac30309f8eacc533764ea7a0e4caeb9c80aecaf339377369fa9ddb87fc027ff6bf5d6c149e05c2bbe77be082f2feaa4c8de8f56861382
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxZk:A3mnXoZjzyaEFo3+aWii0CJBSUvk
TLSH
T152254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 964KB
SHA256 badb4181b2f8afa6b9b1171e6c5f6a105b5a9d8440aa7aec79d28b89038f3623
MD5 d13e7dcc6ed1084ca1a44ac1ac23e8d8
SHA1 cdf496d7eed76ac71ae8f3e396dbdbcb0f2a7fca
SHA512 64622ecabe3e059c2c116bdd03d1b3c49bf8d24b49dbe007c49ffe4052a6bbd3d7106e0079b9e309c99530cb7d9b0107c56c00ba4778cb5d33ab98452e9b4242
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxW0:A3mnXoZjzyaEFo3+aWii0CJBSUo0
TLSH
T132254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 964KB
SHA256 07508fc0b3693b6d99e09cf99ce0b00a6068b2c365ba7fb47b459ed3fc51534b
MD5 2e544f48ad09020a004559e512e3a758
SHA1 09e965036d6871edf978ecd0fdfda67b62c3f82b
SHA512 f8086033b468c9c759fe213461dbc706cecde3b6ad45d8fb093d7a88ca59254542d8771fd60c26969e297c4ed803fd71ca79a142a896953af962b5ae6b62c884
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxl70:A3mnXoZjzyaEFo3+aWii0CJBSUDg
TLSH
T13A254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 964KB
SHA256 1e00a21ccea4d2b285d538f9e2422762e38175275fc26b82c9ecb6ef43cbd3f3
MD5 9f3b6adcd47e11e068f90084c6a86d78
SHA1 8d698324ed816ae8b534a23304d436503fa6fed0
SHA512 226990ebec80c9f4dbc68b14279c2a396fdc9124de92cc7bfc4254a9e6986320c74c8c2ab7ba18a20e75a19f5697b374b8374a814d1beef40edf027ccc189d57
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUx0r:A3mnXoZjzyaEFo3+aWii0CJBSU+r
TLSH
T1E3254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 964KB
SHA256 adccc99ece6a45e564d8bec1d09f6d951ec54510a3d48664eea80cd00880e654
MD5 916574fc43ae15de5a7b7b0da930d75f
SHA1 35132781c7f98955b3ae6d7be2e6e5930c13b5e5
SHA512 a95a4d94b1b46de8291774a41d4eb5fce44688ea04c40f12698d5f55d5631883e414256ee07ba4f7a2c073e42f459086f857bc29fce725c21597aeb5b80ca6c8
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxKn:A3mnXoZjzyaEFo3+aWii0CJBSUkn
TLSH
T1FA254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 964KB
SHA256 0134c4ce04a16a9c1320b882fdfa2cf2f7251b882e21fff935c8c3354bc6e1ca
MD5 dadaaea722de4b8200a1333c9ff1af88
SHA1 45d769b5ba761edda1940f6f2efc0627cd76d374
SHA512 a4449d96054cc270354f0fa1469ddb064897314b6ab0fa1fc6fe003aecab8025a97721dfa5a2dd59dae68b5a108f6987d22cc76192b4d6ad96fdcc6eeaceb15a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxAx:A3mnXoZjzyaEFo3+aWii0CJBSUyx
TLSH
T10D254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 964KB
SHA256 07f16527d704f5b10e0bf3221f20f84efa8261f8f17d1b46d73d84d659dce150
MD5 d3577a8e05f046ea352c08089480b8d0
SHA1 34789e73619d3f528b580311637e9a04c91dfa0a
SHA512 c02a1c514b36a269fc18aa09e2450d0eb8cdb9b5801fdd2754e79f7afdcc0393a6e7e66ae4c7a4e16287522c3fb8bf93ff159e4e6fecb9d93255f462c90ff872
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxCA:A3mnXoZjzyaEFo3+aWii0CJBSUEA
TLSH
T196254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 964KB
SHA256 70bd803724f429f9b149da1baa2aae0f0fa96e89f572ca74433986bc87672456
MD5 a1b1832ada5bc5a2ee44b2da67c17034
SHA1 efe30703c80f682b02002ff91407f074ab3ed8ec
SHA512 06c7db0e240147dca9f48405c0214491605cb9a2e6259c43a1d76d7a4c5be6153ea9c252f656274074f8f57629de0a58546fd1aabfef78b01a55d9eac87f81e7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUx79Q:A3mnXoZjzyaEFo3+aWii0CJBSUt9Q
TLSH
T188254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 964KB
SHA256 086b947ae7463d4b03393ee7b33081c4a0b3ec71294903376ce29498bdee52e8
MD5 3e065db40c278aa686f692c0c3b4058c
SHA1 6241c1bf2a9051e63af3d07e18ad1197a06c0dff
SHA512 405d146a20cc55d40ac212c73f3c2cfa46b72ffe8f7971a3e254114583ea77bad4b6898edc62b49feaed26c070231ce2eb039fa33b04feaa83176395cda0d282
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxK4:A3mnXoZjzyaEFo3+aWii0CJBSUI4
TLSH
T19B254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 964KB
SHA256 dc0669abb2082e0017180b13820621e840216176710b34cdb250621220e625c6
MD5 8a15a9c841e926ff71f711e8974ab362
SHA1 c9373c5961058f0135866cfa47cc63aa0d6fb92e
SHA512 c7d7246aca99b9bfcea6b0a11c86d2863bda3f5cf7432444cfebc8210bcdd1b529520eb148178994abb496633696b29c236d62597345091cca6841164d669dd9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxRu:A3mnXoZjzyaEFo3+aWii0CJBSUbu
TLSH
T1F5254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 964KB
SHA256 fe2849d59d65c7e1e7110c0d6697f4908255a2ee774b07d77c004e0a256ba81d
MD5 95e0105d72349f8970b735414b355d96
SHA1 1d42939a8a93402a0817980753cf0673c77bb9b6
SHA512 1cd4a9837c4b2506546899b2643b5876af1af534479b04c789488ba85a2897e6db08335e4d3179ad223a51d864bd30f4db39197b015657ff8814ae46d52aa184
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxkj:A3mnXoZjzyaEFo3+aWii0CJBSUWj
TLSH
T154254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 964KB
SHA256 63a4fe7046421f245ad5462250b318f0a47fda5a84b4bd2c7ae81901b406c06f
MD5 98cef6fbbd6a47d6a2ae8676c959b511
SHA1 0d082b23ecfe0d85f2abc8fd92e0f7e7f5bee329
SHA512 8cad97171de7a80a5e65508c5fda87b7f5577dedc875648cec0a233bfdb38bdd176d65436d3c1744f9545dd251581fe86ca0f0294c09d63daa980cd3201b7343
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxFg:A3mnXoZjzyaEFo3+aWii0CJBSUDg
TLSH
T1F1254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 964KB
SHA256 8c9df22029d90b25ed885fd76a937b72c6570c9617e42aa67a2712da06ea2a90
MD5 c9e236229df9410c67af6b69c1dd142b
SHA1 d6bf08092da569611c23870345d9e16b36272c70
SHA512 b14e0f7898af7a079447b9bed944441c00f4a505598053ff4de27ac3d2869c8e2c4944cd2bba00a4cbe252cacf3bfb1a9049a8d4f2bfbb8a2e9f41755dd06c29
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxkI:A3mnXoZjzyaEFo3+aWii0CJBSU+I
TLSH
T130254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 964KB
SHA256 f7c99c8f73c685b3de97b31da49607f9c0f5c6a11a9dcbc3272f8bdc768f1fc3
MD5 84b174f6698cb1f06abf387d574b7eb6
SHA1 53e01661e16a1fd908b4d2167673647f3da7da76
SHA512 d16229f46c0687b7e1c4790f867906af3a51fcf337648c7fc105efc6c5ed307a50a8de15db744482c4484e478446a2f5492b16ddfc879884f0cb1a79ccf0c7ad
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxWo:A3mnXoZjzyaEFo3+aWii0CJBSUMo
TLSH
T1A8254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 964KB
SHA256 75ee98cd671b7ab3b555bbf63e471b43509c8e8beef64ad7b953b69f00949fe4
MD5 34005229e1a764872d4f2e2dbab00580
SHA1 94723ca54818209b1ea910a567c602b0b4ebe0fa
SHA512 7b50a1ef801bd5f6a05ffdf0739f472be62e6d9c523770ed70286a2fcbfe920f2186cfb8cf700ba87cf49550a09b6f84259974937b9c9a3e2dc471afd48e84cf
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUx9+:A3mnXoZjzyaEFo3+aWii0CJBSUP+
TLSH
T161254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 964KB
SHA256 6ee66d9dd72ce756f0e4e2b36ab7bfc68018728a681b470029d2daf487678a17
MD5 24f912dc387c43d956145a39bcaefac3
SHA1 0ab9fd2c7294e411e13a00017310b37004e7ba3d
SHA512 4602aba61bc391ca8b95f3188aaeacc28de149dc8e078fd6f2a510eb7bcbe7bf8342795dcddeea7ef9321191e6316f25946c826829e602ff7c466153f4797e49
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxrQ:A3mnXoZjzyaEFo3+aWii0CJBSUlQ
TLSH
T100254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 964KB
SHA256 6365af03fcb6b2d2d3b10443bf95b4ccb047d28b481e89dd4fcff30d27670ec5
MD5 0eb3d1c67748f55f3bb00e1eb3d96d0c
SHA1 dead2e563d8a791ce69a9b8cbe2d9e89d1c3bcc5
SHA512 6e41ea788a22dc287a52101de8e79c621d5276e5ab732ff56d10e12ce5d4c4e65f53bedcbc246f3d0d3e1d6fbd316d8dc9b932af75cd56220a5f9d4ee1615d70
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxgX:A3mnXoZjzyaEFo3+aWii0CJBSUqX
TLSH
T170254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 964KB
SHA256 1fd791d49e4233600ff4c1224e368e91dabbb7cee0c25556fed4e82dcc01ff40
MD5 fae5fa7b14f36cc1ae8ea947a97a3764
SHA1 479e65b160ef157fee592f69ac31de5f14d33377
SHA512 58f8f7c7535fd8b72b87fe5c5de49e7210e974153b2be0a02359519fe56913848745cebee0e1161bde3bc10dfda0db0ae9061461d25e79f153ffea35c1eb396c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxWL:A3mnXoZjzyaEFo3+aWii0CJBSUML
TLSH
T123254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 964KB
SHA256 570de6314a82d6eabaa6c1be127d2953bd098907573fa217772f82f73e1a51c7
MD5 0ec2c385eb4771552b42c157d4a4d2d6
SHA1 a85031cbcfee86fe150553f2605d1d681fd40fa4
SHA512 8b61f2c0871a724d8098be6b32015dd3662a8416e18f11921c4d47ac3fc639d9dc75686fccc3e3301be430738329bd86c83d83d545bfbb3b1f999ece09186516
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUxqFC:A3mnXoZjzyaEFo3+aWii0CJBSUIM
TLSH
T1EB254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 964KB
SHA256 0df70e27efd1997c4bffea8c171d25869ffa79bc87c8334fd61595285f72942c
MD5 0382a014ba752b3e19041bea6a94f01b
SHA1 88585ced0a47536dc63cc7058a9c1152b8c2123e
SHA512 3a8ba75c637a3f89837465eb643d264ad489ecd5e57abb37c815cf46cc08777aebd044cf7a873ec2eb01c66e88107a188a83b39e52ba6039d2c97c825aee30fc
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zzXsf3kC4OUtNUbTvSUx7h:A3mnXoZjzyaEFo3+aWii0CJBSUph
TLSH
T12F254827DA6468E5C12E8574DB918601F77378214BE193CB93E4D23D1F236D06EFAA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3052-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3052-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3144-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads