9817fadaebf92f8d57d9b440a2be6ce661ea4408fa9a5a138272e69508fd2029

Analysis

max time kernel
105s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 15:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Size 917KB
Sample260714-sfr2dsft4m
SHA256 9817fadaebf92f8d57d9b440a2be6ce661ea4408fa9a5a138272e69508fd2029
MD5 01ada7c453c261b3edb50fe8a4e847d1
SHA1 c8fdea689980aee84af6ca309603ec51612c3b12
SHA512 0f80feeeee42df26a3acae1726f81914d319efb9f3de5ea991603b33d6533a454e6dc63fa6008cd45aec1ee19ed48fca4023613e190a96267ddd52c19d47641b
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRa:bHuHNgHg1flT/Vk3HYwLfUwaoEaRa
TLSH
T18A157C23DEA498E2D6B648709EA68701D775BD600B2193DFD2A4B31E9E333D07E32715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5628-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c44a-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5628-21-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4788-22-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c6c-59.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a3e-218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982b-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bb-443.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bc-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3b-572.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-670.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c2-737.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-799.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-874.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-901.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-1087.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1168.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1304.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1329.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-1354.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c44a-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e1-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c6c-59.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a3e-218.dat	aspack_v212_v242
behavioral2/files/0x000400000001982b-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bb-443.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bc-493.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3b-572.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-621.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c1-670.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c2-737.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c3-786.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-799.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-874.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-901.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-920.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-1007.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-1087.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-1136.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1168.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1176.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1183.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1304.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1329.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-1354.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1380.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4788	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5628	2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
4788	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_01ada7c453c261b3edb50fe8a4e847d1_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5628

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 917KB
SHA256 9817fadaebf92f8d57d9b440a2be6ce661ea4408fa9a5a138272e69508fd2029
MD5 01ada7c453c261b3edb50fe8a4e847d1
SHA1 c8fdea689980aee84af6ca309603ec51612c3b12
SHA512 0f80feeeee42df26a3acae1726f81914d319efb9f3de5ea991603b33d6533a454e6dc63fa6008cd45aec1ee19ed48fca4023613e190a96267ddd52c19d47641b
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRa:bHuHNgHg1flT/Vk3HYwLfUwaoEaRa
TLSH
T18A157C23DEA498E2D6B648709EA68701D775BD600B2193DFD2A4B31E9E333D07E32715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 61d1a6f6389439b337878dcf80ff6d3abdc80caec9e4cb7b24201cc0b752eb0a
MD5 97ce19bb4280d10c452164837267aa25
SHA1 4261795388e367d9cd94537450b0753e27ed577a
SHA512 6aab0e25fb46f1881438d619c90eea351efd7f9c50ab8ed3cb95a1731fb3be5768f15b6ab9f718a1f72f3984f730b03d1329dd4b81d4ed0264cbdc481adae6e0
SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUwaoEaRaP0Le5ji0hmxNrM:T2agnTkLfUFPji0Aj
TLSH
T158656C26FA7486A2D0B3C4B4C9D2974AEA717D510B3086CF8294F36D6E337D19E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 965KB
SHA256 701490d1a178a8ba84d4ad8dfe806523b6125ca2c08038fde5de3a37d5138726
MD5 908a7457b8eb85fdeed3f9f5cd0147bb
SHA1 f7ad19bc7afec9630da1a413b1c2862af7681432
SHA512 e791ea344132a930592599e70f73b05acc32a6700fabc61353852ed1874ddb755a9709c6dc2d1751f9c52a18bfd642ad4e498fc17264e739d794adcbbf20fd14
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRayb:bHuHNgHg1flT/Vk3HYwLfUwaoEaRayb
TLSH
T159257D23DBA498D2D6B64970DEA68701D735BE600B2193DFD2A4B31E5E333D06E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 940KB
SHA256 b1f8523ab25c0036279aeccd05f441daccbeb12ad376bcc9b070ef10c744b58a
MD5 264d559e1b1f4f35881eed65af1bd8c7
SHA1 0d1e379d61e2536f1b64a59a4a25595c760795dc
SHA512 ccda1225b649928fdba865d6dc8c88f0ab907c744ceda5fc32672696656f06f4ce23d6443380c9f57c075c235f2d9fe9db8668d2cd15937ab88b1782b43a8845
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRao6:bHuHNgHg1flT/Vk3HYwLfUwaoEaRao6
TLSH
T1F6257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 940KB
SHA256 ba3046f209fc1f60d06e94bfab6307bf7c6e3e7a46ab3385281330866e8d47a7
MD5 75a52459a37278473b0a5f7b1c7f6148
SHA1 2a7c98f26d88e967e054a16f5ffdc6ef3074b4ce
SHA512 8ae1157d4018aefb8959c5765a332fe5b7680f86cb6d4f1f069b1e975d2a75f81356b25f79d7f648354ed2298774818441e704a2b25ee1519351a1d3e17204ee
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRasN:bHuHNgHg1flT/Vk3HYwLfUwaoEaRasN
TLSH
T170257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 940KB
SHA256 660ef4e2bffdb7d0dd9bec459ce09e219782066481f45b74fc39f9d7c3c73926
MD5 7d1f6c23d06884f1446c68a0eb07b83c
SHA1 83437ead8ec08d2dcc0657829f0ab99f850444bc
SHA512 bb9e5f04520a589206251f04feb8b553272c294c39131ae135207331bf99159e0b9f4fcb884ff8503c52c0d73c1ce30437fcfd959ddd7b3204c88b9352269e39
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRaif:bHuHNgHg1flT/Vk3HYwLfUwaoEaRaif
TLSH
T18D257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 940KB
SHA256 ab1cf63770395c435b9161a681432a148a590741f73c4f085c2f8c5237343862
MD5 7b329fabba1815855d907eecbee5f4a2
SHA1 90ca79f83943a7b0321106042a21609056f32ce1
SHA512 c6e33e1538070b85dc00a659e0fb32a2060700152d3550860641a5486e48c8a585dcbf6804c64af1ee8bd0471673d0c845ccdf3324cac08e44d73cf29eee3aa3
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRa8o:bHuHNgHg1flT/Vk3HYwLfUwaoEaRa8o
TLSH
T16E257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 940KB
SHA256 af2d8b0407400313a1274c06bb2f05ef7083fac9ea8e478a33bc4882a6f182b1
MD5 0406b3c2cf0ce9f5e7d5935c6c68bc1c
SHA1 3a9821e8f339cdf42eec73dced03345b1e3c04b1
SHA512 4ecb1197ff0af78197dd25cef708d55d674f5b7ae96917f372a30c0b6fec32e3edb8afaaea68a74b40721da51eec7854425f6f5eb1e47becf9547438471365bb
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRacu:bHuHNgHg1flT/Vk3HYwLfUwaoEaRacu
TLSH
T11F257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 940KB
SHA256 e6be0df8668032aacedbe2e06555e8e83113b57bbddece13f4a8fa681aeca57e
MD5 c36e8c87589e814bf8e42fde9075b699
SHA1 f75ec16dc571a25981f7bfb712579705e7d15a34
SHA512 c358201a80208de8e616a280abdf014f9ce19a0bf0111d58bec4ae7f725692e43cc4952ca9fb9a3d2fae2e4b44f41344c88abe02343154bc41310679dfd1cfbc
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRag9:bHuHNgHg1flT/Vk3HYwLfUwaoEaRag9
TLSH
T160257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 940KB
SHA256 0ff9d96a043625fd9d5ae493d0e89ad220dd9fe88d38e96b3a30f674c4191928
MD5 4726ef319668b8c2acf94330b7a720ce
SHA1 b114e113aadc48d825ecd08e96dd57a47ca94526
SHA512 4d7a40286caed653664ad0593552fab9e8ff85892506bd9c10aad2e67d8577b358412d30ab4f5ed35338838a604dfc2d3a291b1088a2f763a45bca410b278960
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRaoc:bHuHNgHg1flT/Vk3HYwLfUwaoEaRaoc
TLSH
T1A9257D23DEA458E2D6B648709EA68701D775BD600B2193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 940KB
SHA256 921719560af0a58616e10d103a2730ef893a5d2699dfaff84ddeaaf08e209b62
MD5 24c371d07b4e48b300a37f938d908353
SHA1 563ef04bd20f5d185eb565fe11ed853c350b0b5c
SHA512 edd8423b2d8a98b4c728e8074325e6077653c445b3615e2d1145f281acd588904b54732320ea317a22ef09db214460aecbf69203b8bb60e2262e98d024ed8e04
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRaBp:bHuHNgHg1flT/Vk3HYwLfUwaoEaRaBp
TLSH
T16D257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 940KB
SHA256 520314bd15c8537df94044a95d0de70b91f4643f0a591244d98d945579aba9b6
MD5 979384f6495a77e1712c59bf5e3db190
SHA1 28998da3d578c5c55fc597381755ded7be71e9b9
SHA512 3410f083c21460d923a5c679a202bffbe606fd4931bf70dd4e73d4b4b9f73b9401cca69a35adc63e42da331e2f2d06abfcdfb1d92d7ce0968ecad5178fb7fa2a
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRaW0a:bHuHNgHg1flT/Vk3HYwLfUwaoEaRaWN
TLSH
T179257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 940KB
SHA256 bfc2086eff6aa799b0335fca42f3778bdb844c586b440590854a8ca64f1b2963
MD5 e68e1472f9053ed8be641e69d3ba7435
SHA1 875d3413cf0d937009562a4bb0a55976d83440b1
SHA512 f20cf1f726ec642d50a0df3da51c2362bf478309bf240e4f3057a26002dd4a3325605cf7a106b6c16223de6c575c4e8978b7ddaebb25a9ee9267f804546cab44
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRaaF:bHuHNgHg1flT/Vk3HYwLfUwaoEaRaaF
TLSH
T181257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 940KB
SHA256 0141f0095718210a57537df83861e34e637fe703f101c6af12ae003258fd134f
MD5 6974032237d2aa888d8e057e0fd563ed
SHA1 53db9890921da25041e93ab48d815eff03e4b08c
SHA512 9de037bcc114f62c0088784d07d1a6e232948d0e06f711a2c0edec8a83255ad6f9f94dd03f8b3b20393fa363b856d72d002827ee7a56e598af41f6aad6abbc84
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRavC:bHuHNgHg1flT/Vk3HYwLfUwaoEaRavC
TLSH
T127257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 940KB
SHA256 76f9cc8269bbd0c0781ca1a00e7063151bb2d23fd5242dfbb1ab30ddb37955ec
MD5 9941bf8007c0d0d9c6e240cbaaf847a6
SHA1 5603b7e7ab02a64b7be76d1f78782eca6dd1bba6
SHA512 d06632ae4246aeb5d41bfed7cdcb5359c772bfd53e983075439aa8e433b15af28fdf9472a84261a3cfbd65daae7a79d96912cff32aa595e41e146f8518aa7131
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRaQw:bHuHNgHg1flT/Vk3HYwLfUwaoEaRaQw
TLSH
T12C257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 940KB
SHA256 1e0c9eeb5d952cd154b6b2a393a14cd8dafa4dcdd95f6e67496d3f28eca997fc
MD5 3bbeaa46c3e5f86549dad3a5e0773c9b
SHA1 3e27812e9053e772c803199c48a824fb074ef46e
SHA512 aa093d03b274bde440dc0bf3dba526c48963f9bd11ea785117513b17487919e0e245d6876a55f8e5055fc3ef729029807d361e26ef98cf6ec286dc7817d011a1
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRavT:bHuHNgHg1flT/Vk3HYwLfUwaoEaRavT
TLSH
T1A9257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 940KB
SHA256 02bad8c3594601ec0eaf28bb6dcee5b6fd891b3bdd6162fd0161eb5a2d213ff1
MD5 9d8c327db0bc85b89ecddf9aa0486859
SHA1 7602287721381c88257b316df61656f24d5661ce
SHA512 65cc81414771869e74a229e125a05007bf32f1db174c4b6830a0f82b413917c0fade3339a5dafd779b0aa87a9edc3021d0b1b9a448fb9d4c5f8ffe5669a632f6
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRapu:bHuHNgHg1flT/Vk3HYwLfUwaoEaRapu
TLSH
T19E257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 940KB
SHA256 e34915a0d9c201fc66a23839b755cdd1b521881c65e13ef2b0f689f7b2ad81a4
MD5 be31bc45d81652b36157e218914373af
SHA1 dfbc47ae75cbc7fe6d7e2035eaa8fa560b2331cd
SHA512 2dc2b74df2de51dd2e053c6d4413c0520556dfb2d5be83c076f0e146fe0acbbf2ee4d9f3506f9095879dd53e11fe33730d2c44b9ec40a47f08eb402cb53c7e67
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRahb:bHuHNgHg1flT/Vk3HYwLfUwaoEaRahb
TLSH
T1AF257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 940KB
SHA256 3702c368fbc3a6eb820347151074f41bfb66b7cb77cd46bfde36699c05445779
MD5 837685791b24ae7f704a1759b81a70d1
SHA1 2d2adc09f1f2f3f5057b9fdf0765197b7d35073f
SHA512 5fa20c97a3f34269460a49664213e48b9dc112656a3db2c5ea7e24f32f416218f356799f6d4d6ba4535a4e2930ff90734094979f611ad44723f778d163c82587
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRapf:bHuHNgHg1flT/Vk3HYwLfUwaoEaRapf
TLSH
T143257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 940KB
SHA256 446421aaf9237105914f2ffbf9873d1ac16314726707d98d3ef53d0d7d3360a5
MD5 e55dc6967a3896f99e9586a724861c63
SHA1 77ba0e26016c5df2f1ca89ea7ca22698e45a5785
SHA512 6f852e2aaf1e206548ca583cfec2138475da6a9bd1016b4286507c5d752b7540a3b99295fb569eddb77c93b55c0ef156d345fe572575e2221d5a238e50b864b4
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRaSK:bHuHNgHg1flT/Vk3HYwLfUwaoEaRaSK
TLSH
T131257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 940KB
SHA256 1ab7ad6951e6dba74593c1bfa5a5dd5f712ba8f6ba8280ea7747a62132365d31
MD5 d83b5440735b08c0915d1d6619040358
SHA1 958b9d9be3397a31ef6121f6923cf8e274a2c394
SHA512 f9acb105fc01d32abf29c86bed881394220bf8bbc492960ba4a5a9d9e365ae0e024b7818381e275964f8ed7d058fee0af4a5abd66c6d9c44ed8a4eabcc45a57b
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRa3k:bHuHNgHg1flT/Vk3HYwLfUwaoEaRa3k
TLSH
T1C8257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 940KB
SHA256 399eea9bfc747f899b0f4faa5b1481b763fe8b8fbd72c487c5ed795bb3bd25e3
MD5 7274449d35f6a378545e875cca57d78c
SHA1 fe5a6809c37c35da98dd342e8b3c321ab47fcc1c
SHA512 a3417dcb51b7be863092904e9f1c8b3203f88a308a0d88ab09d55f271c4e810c4602e493b9848a77924064b91a92cc2295b2c64b6827f33de71eb3ca942254a6
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRaA0:bHuHNgHg1flT/Vk3HYwLfUwaoEaRaA0
TLSH
T1C2257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 940KB
SHA256 f64fa95cee9c8729b87994995618a65d7a87de1e738048a87335c197a7072cc9
MD5 5417a703e2308e0b61d58b9302ed9d35
SHA1 20b53d2e12a2cd260b34657d04474108d2e002fb
SHA512 932aa5a5384466fae814fe37ae59e628df0675e403b871202c2b07952532c4988b5bdc2f4ab2b5489c534edded10207e6c3e25cd70b7b5e8c99dfcb2d389b376
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRab70:bHuHNgHg1flT/Vk3HYwLfUwaoEaRabg
TLSH
T18D257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 940KB
SHA256 8554a32c7b9fefa8fee64f0a31854770571c53407d185fa1e517e19a160c4a33
MD5 4f13658d0aad4c9a10839b3a1ad2a000
SHA1 2f6b13bc77956b7befad4602e26d6f5a9a9e9a10
SHA512 caf2a42bc257d74f83fa15d245f74d8b406b993aef12387a32bbdc8ee907bc1720f061ff9b9b90ae646ef1ba2eb79e617e0ec961182898303cb018476cd87140
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRaWr:bHuHNgHg1flT/Vk3HYwLfUwaoEaRaWr
TLSH
T106257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 940KB
SHA256 c0f1f8ef856d2c291d80642766d341821790d9fb4bf4cf125a60fe26364026df
MD5 af7c5b1b3f924f7a093c26b7d67d84e5
SHA1 eb5c6be75a11995cf3c6c2bf0b0578ef9519c6b1
SHA512 d2d0a63adbe51942ae51ccd220de59243492224736564139e50dd427cefda6a323a30c1699ad5df421871f2429ff18f55b0cfb7dc8bdf90e3155e2177c8e522f
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRa8n:bHuHNgHg1flT/Vk3HYwLfUwaoEaRa8n
TLSH
T154257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 940KB
SHA256 3b48ef868333e61a541ee8c096439647870d41a9e486ebf2cc04676040a2cab0
MD5 45fa3c19878c625a77aea94abf8eacb0
SHA1 c715657ff34156db92176cea932650ee5b80507d
SHA512 530af8e7b5f904afb169e7702a092893bf7bd6b51e0c2a645994bb887b7631bb94e14f9eefdf054a502eb76d4930d37a16dbf157b1fb090df50f76e29e2eb790
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRa6x:bHuHNgHg1flT/Vk3HYwLfUwaoEaRa6x
TLSH
T1E8257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 940KB
SHA256 0838fb28891b717a77c6f8839dcadbc21d133e812cf620d1530532777cc5b9d7
MD5 36506cf06408baae0e070f6d0948c736
SHA1 ed9191ff2d57516bdcda5a099df0d214552c8838
SHA512 3958297edd88754088c9c0a02979aabb3d73db835ae49b28527175e58efaaa6dfae2b3adf1d8f9fc9d6fb41e0af836e9919e022fded3484850967b1e091a9a54
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRa8A:bHuHNgHg1flT/Vk3HYwLfUwaoEaRa8A
TLSH
T140257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 940KB
SHA256 56ca1ec5a945fe777c65abb8a2973e8fea170bcf226038e006452f3d42a1878f
MD5 e164f44a83303b6e667ffed1486aeeb0
SHA1 720fee2541ba5e1e221be26e662fb6376148a907
SHA512 2855e14f1433fb0b93b63fe314c82c63ae9ca73f652cf637419a0b22887de8e1b9f7618cdcd603e7d6f122cf2de6e4b4b21ba0e0d434e454bf8a4c637d0348c9
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRal9Q:bHuHNgHg1flT/Vk3HYwLfUwaoEaRal9Q
TLSH
T17A257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 940KB
SHA256 682e7f20bc4daebec9da8b3128f71c40561140fd9c58532bc8157a9283b80201
MD5 00f4b8db45baaa9a8e62a344ab4b581f
SHA1 7118bdc46862f8a345d9bbf35391aaf55cf09e61
SHA512 cebb4780be50294761b7fcbd6fe6a87c9e8ecb079c15d87bf4deae778c07ee5b0714c82734081dc5bbeaa0d4a7a9595b57d36fe2380cd961b3470d52e9518f79
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRaQ4:bHuHNgHg1flT/Vk3HYwLfUwaoEaRaQ4
TLSH
T176257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 940KB
SHA256 1d6176a1e45d082671e7edaa35c994beb1b7f65dd07e8150bc0a0c0b1338febc
MD5 b70c1d57f478cf55aa18ecf10065e1b6
SHA1 06f820a51db2784db300b48feaf0ed37951f28b8
SHA512 89884a2cc078facce1aa8203b3d4a1e59c9af982c9d6fdbebd7113bff9f1a693c68c732211c58c96e9fd25f80f4b61cd0ea61509379fc0fe22be0f7f664624cb
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRaTu:bHuHNgHg1flT/Vk3HYwLfUwaoEaRaTu
TLSH
T1AD257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 940KB
SHA256 b2db632f3d1e328799e71df749dc1443273ef8e2edac893fa128372d938f5cdc
MD5 d55260c465b9b5176695d51ff884d078
SHA1 0e11bd829fda3e07ac51e875d1905eb6a1035406
SHA512 c47d3ed078f3d921dea8861526942d5a22efd9aa6720b0492996e93453b3780d4e1717fc0926fd6b3f3f22f2974a89f42ab41a7f737eeebfba6914cb5225d006
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRaOj:bHuHNgHg1flT/Vk3HYwLfUwaoEaRaOj
TLSH
T125257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 940KB
SHA256 63d6aa3248847fa2acbf1c2beaff631161def347628b8ef5d0a7b6a72d0d51b0
MD5 aa5318a302102c88b60cda27bcafb46d
SHA1 e976dad1e268d96500b6dedb268ac8493c7cc4b9
SHA512 cda94f9d3f4d1c4486803593e7c734dcec69bfa1547698e2645df6d3c3368a48e26b304f6f8b857a0ce4d3aca0373f7262d62f46889c2249f2c80015762d2abf
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRa7g:bHuHNgHg1flT/Vk3HYwLfUwaoEaRa7g
TLSH
T1A7257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 940KB
SHA256 ff72a42e485a37a24a500eefe4855c82c42015cf1e20b46e508b0cfc5739e5a8
MD5 37966742b51c2a9f72f92b2794abb027
SHA1 0b4ba7d1a5cc5eef4b7f68a55cacdf390013f78f
SHA512 1674f520c08044d459c82fe14b864d5482f7c3896ee0d6d65ac83a3c708643b13a5844e0945e380fc8a1e07f247fb6b73a97273a873f782f7c02d000488ec552
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRamI:bHuHNgHg1flT/Vk3HYwLfUwaoEaRamI
TLSH
T12B257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 940KB
SHA256 eee4fd1417a65da23a84b055cbb9b422613b4ee73420a888aed347305fc5180b
MD5 2571bbcd83c29f890600c9199d5a5dc0
SHA1 2e1a075e69c14894484ab02f9287643f7b76d389
SHA512 f52f80310801c9ecd2a2e6001a989acbdf3af5e40a2afdec88d24c72cd2ea60d630d3c7faab763688a6668616f20307c7e7df419b4cc7307706b3cbcbd0c00c6
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRaUo:bHuHNgHg1flT/Vk3HYwLfUwaoEaRaUo
TLSH
T1D3257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 940KB
SHA256 81dec83ba3443d67c16b528a5e2034ef20f2dff2bd6b9a433f4b1b889e993d62
MD5 c513766fdd340b1181a13f5030e845da
SHA1 ec24fecabfe96dea98feadd576aeec0b8dfbfcf1
SHA512 3835d7b17186145b86eb08b6a5756dc04794d21f2062fdf165afe51344410a40b3b29749b76871fa16254bfb0aeb2e7fbf7af7bbf5239d255014bd67ed7170f5
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRa3+:bHuHNgHg1flT/Vk3HYwLfUwaoEaRa3+
TLSH
T17B257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 940KB
SHA256 0d1d3ba0778bdeef95c6783bd1293320eefddc620968c5dd8861e300e1db1699
MD5 0349da8958eaa3c49bd73023eed2e4a7
SHA1 253b9a6f7b02c73aa194f5a076a577b1dfe249fa
SHA512 163eb99ae997ebdfebbf41541a3d483c18f263dcb964b64aeb7c710bcb8a70d1e68e094edf2da4bcbfa6d9320616e21dcf08e69deeff656a65c590df58b04db9
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRaNQ:bHuHNgHg1flT/Vk3HYwLfUwaoEaRaNQ
TLSH
T13C257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 940KB
SHA256 76d9b46e0bb2903aec29990bd41bec2d073e72c4273dbf6841f76db2b1162e8f
MD5 293eba55e072994e5ec1901c992fa089
SHA1 8e2b1053566c1e679b49e89558fa0436b2e7b849
SHA512 1b35c59e2d43c6a4887b3b6aa49d706f3161c43881773432e6a56d448905a6a3999fab5e00beb2ec580862d442e3df611ff386ee3665bc921912410f71480e0f
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRaCX:bHuHNgHg1flT/Vk3HYwLfUwaoEaRaCX
TLSH
T1BD257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 940KB
SHA256 e99224c1f3e73b71d1a1b234d0c965f5a43c2e37c45523ebad0a837913b8b9a4
MD5 cf914994d315f49be90afd8c1ebfc989
SHA1 eb5079284574a42b4b5aee39d766ba339adc39cb
SHA512 d4791ab25bc997ed8756e73804143ec35298869e82984404d4b06d5447fa5065f38569f824b5dc5a19fd23e17714a47c61073d4ecc4d1576647ddd437300a1a9
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRakL:bHuHNgHg1flT/Vk3HYwLfUwaoEaRakL
TLSH
T147257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 940KB
SHA256 a58ce20d7963078ce74f92149bb176135214336abe000602b03a3b3a86aa4341
MD5 a98abdd8ae2dfef703f96efeeb95c81c
SHA1 b8b2d6cfb5c197f30a92d2d4e0040a5c810ab2f6
SHA512 89230a1094a04bea4ca0d0a27b04f93a012414b4a59c6343d8225e8d0e94bde625a2d8718938cf9409701e32baa587d8e7790cfe4fec71b0a75c3156f0c13f43
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRaAFC:bHuHNgHg1flT/Vk3HYwLfUwaoEaRaAM
TLSH
T1E1257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 940KB
SHA256 304032c0482a4b6ced4b09487a967563b0cbea73c90d44130bbcbdb4466c0092
MD5 326158fdc34b314e737459f91e2faafd
SHA1 29489604986ebdeabe72a0518e2e34cda9dd64cf
SHA512 d51c4c1c4735f862ac72da32469ff3bbdccec592ca7c8e6ddd9796b617fa198c043b9ca3de570a3ee8d13ba00d97e7f16ba3174af805c5b825b11b6976f94e48
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaRahh:bHuHNgHg1flT/Vk3HYwLfUwaoEaRahh
TLSH
T19E257C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E333D07E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4788-22-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5628-21-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5628-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads