9e116b676b033455bff7fbc5bd18951a33966653f05dffd42f12292b765a5695

Analysis

max time kernel
102s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
Size 838KB
Sample260719-3llfxaaz2w
SHA256 9e116b676b033455bff7fbc5bd18951a33966653f05dffd42f12292b765a5695
MD5 117c4eba7b19b79ffb74ba91ad4ea41e
SHA1 690d253979b15e026622d5dbd18ce7994f831c99
SHA512 6d7e1c7db159d7725a22b64c368dd5fd26f65c2e774bc51fc72190ccbaf37ee3adb2844eb4f56ebf2c9c882e0700445ad51789b75b9fb418103590b39bc6aede
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUx5:A3mnXoZjzyacNVOE/EYoCJBSU7
TLSH
T134059D27EE646CE5C22A89749A918601EB7178714B61D3CFE378C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4616-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c58a-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4616-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/880-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-510.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-601.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-717.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-743.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-787.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-824.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-855.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-874.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-926.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-983.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1021.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1052.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1101.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1169.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1245.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1331.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1344.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c58a-6.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-41.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-224.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-510.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-601.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-626.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-717.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-743.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-787.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-824.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-855.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-874.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-887.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-907.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-926.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-951.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-983.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1021.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1052.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1101.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1138.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1169.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1176.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1183.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1245.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1331.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1344.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1369.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1376.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1389.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
880	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4616	2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
880	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_117c4eba7b19b79ffb74ba91ad4ea41e_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4616

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 838KB
SHA256 9e116b676b033455bff7fbc5bd18951a33966653f05dffd42f12292b765a5695
MD5 117c4eba7b19b79ffb74ba91ad4ea41e
SHA1 690d253979b15e026622d5dbd18ce7994f831c99
SHA512 6d7e1c7db159d7725a22b64c368dd5fd26f65c2e774bc51fc72190ccbaf37ee3adb2844eb4f56ebf2c9c882e0700445ad51789b75b9fb418103590b39bc6aede
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUx5:A3mnXoZjzyacNVOE/EYoCJBSU7
TLSH
T134059D27EE646CE5C22A89749A918601EB7178714B61D3CFE378C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 76899921a93f4835321c969e3a9ec09e70846f65ed7f702b565f239384073578
MD5 f3d802ef80e04a94d1d9a1aef711746e
SHA1 af854a927fa46ade6a4d1eb23a508d3095ba1794
SHA512 50eeff2add575c0efe9f4d950901917c090a3a05e326d6e8970d770d1f7b9cb9e88c3a77c604445e1d5bdc2779cf2b27144f588d276b8984d27d5e737b57e73f
SSDEEP 24576:A3mnXoZjzyacNVOE/EYoCJBSUn0Le5ji0hmxNrM:A3kMCJBSUnPji0Aj
TLSH
T1BA655B27FA749AB5D037C4B9C6D29646EB7134620B3086CB9355C3292F237E19E3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 853KB
SHA256 d9a3246fc169987e34ec95c775bb0776bebf08265a396289a4aa95d23dbb0bc9
MD5 47e47806df2bf61d07a57f93e12dd324
SHA1 6fe1007d6fc59c110aaca3954fa3ee85450c1707
SHA512 86d811f14c5a1044132b981c2504befe4d00f4ccc035d341c480c8d2ade655c187a0971fc1a3278aa39b664730af1a2fd5718b7657a1be82a6190b98c3fe5827
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxna:A3mnXoZjzyacNVOE/EYoCJBSU5a
TLSH
T14D059D27EE646CE5D22A89749A918601EB7178314B61D3CFE378C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 862KB
SHA256 36cb78a712972e9463988c6e08ecdc4d1c85673558e2db5d895abbb3aa45d1ca
MD5 271b25b649545022ec829a88eeda70ba
SHA1 9c639d28b23ecd9b7188fe6d1bcfdc9b4c53f933
SHA512 4377d32fcabede0f66f7c75278e929c6ca851009cb93f22f784cec18c3dd261cbc591372a76cf0f518f021661491a5450a6416eabd58e672ddd4e027b2574454
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxG6:A3mnXoZjzyacNVOE/EYoCJBSUw6
TLSH
T11A159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 862KB
SHA256 0980d6fdfa3e79bc34a8bd47a94393451a701c347bfa0691460d2be803724605
MD5 aa01d794fd4e339d2c1aa7bb792677f5
SHA1 863a94acb8262c91654a2b50af9e5ee9a263758b
SHA512 6d0e2d9c6e1763954ae58e793f64ad989756de8482e886696a751e3a9d5bd089cdf80427fd9836cae20cb4c50334aa069226d648ce93bb8f3a3840360c9be8cf
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxWN:A3mnXoZjzyacNVOE/EYoCJBSU0N
TLSH
T1AB159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 862KB
SHA256 f5366fd7f0bef6f374bbc7e433f31bec38962d08e05833acdce0b35f8153ccf7
MD5 ec8b1f7bf79d79121bb85e02e5155a83
SHA1 161af8d2fb54aa9a3c72bcb0545c3a838056dd45
SHA512 4eba02ec298e5f8e80bffbba5720214b6cdd22808f700f950bcb32a70f756bb9789b1977a1c6d3cbc2f9aacc18fa000a7b590c827034c3e970acf4a38b135714
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxUf:A3mnXoZjzyacNVOE/EYoCJBSUaf
TLSH
T1BA159D27EE646CE5D22A89749A918601EB7178710B61D3CFE338C3191F237D06F7EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 862KB
SHA256 81907bcd65d2dcae5c0032b2caaeedc311aecd7743baf324233c78b022a4c18f
MD5 b7241d66e10a8b73fa8b0d0cf2a9ce42
SHA1 190194e7cd5402cbc3a2c92daf2128332a831fc7
SHA512 afea5c8b611edcf271658d529599461045399cc4ea691539fba8ba18bc017661e6eb1520e22e27675152dee1855948c439f94b71371f273accaae9ab22e547e7
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUx+o:A3mnXoZjzyacNVOE/EYoCJBSUUo
TLSH
T12E159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 862KB
SHA256 73cad85ff7a53cd7639edfee54efe144c6ac7bb7578673d7e8c0e67f4364c0c4
MD5 d7eeead49bbec210a7489faa594c2406
SHA1 584414d0767a3fdc0d24df5f9dcb772d09b9ad53
SHA512 31483cb2f6247a6079233b981670b8c8b684482eb614243bd19133912d4e8b2bf14f014485ceebfe3e107c9264a2d0db0826af18a5c39c69235e02503b37148c
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxSu:A3mnXoZjzyacNVOE/EYoCJBSU0u
TLSH
T1D2159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 862KB
SHA256 912677644c7ea1ce93bb93d9f292514fbd357034505e7a01c7d779e6701b3302
MD5 395aa2f1789d20fcee4e614a7db85416
SHA1 f10793b9a08fff682aba771718cbe4668ec469fc
SHA512 9a743ed032a8b3e4fcbe1b795d9249321dff62c402391ac113ca0a7e64907e4ed9ee8860d70aafbb5e5b74b090fd4a51b6ca68ec8efde90e2e07de1cf5cd08f6
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxm9:A3mnXoZjzyacNVOE/EYoCJBSUY9
TLSH
T1F4159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 862KB
SHA256 8d1108b012da369f9713845a5cc0e30b700481c25f895b75ecea236fe4260af6
MD5 788f01599ef7c3977fe0b5fb5eee5d46
SHA1 eecd468fb3b758f814772728b6a3e51767704105
SHA512 75ee0e5ee5e41002bdc6809bd89aad177a0b4f3e80155f9accaf4ed52d1e0d8ac5d87d1de39baa71b389ac45b4a8ee26c06534dcb26ce2ff11dbefde6f26a506
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxmc:A3mnXoZjzyacNVOE/EYoCJBSUAc
TLSH
T154159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 862KB
SHA256 56be4ace0b770cdf10ef6dafe5e32dc557e5b6408fbac3075325defd7165197e
MD5 11768fa459dac38da049748ab1615641
SHA1 f4537d2aaffd9b594fef89d9aa13eca42fe32400
SHA512 d8b0869ce643f4d9cb3d6142b5ad4d4dce6f30f99b4bd3e4a184ea1bce9a52ed32774cd3798c118b7b0005bd838dd9a4e9b63cadd715cebb47263f22a18113c7
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxfp:A3mnXoZjzyacNVOE/EYoCJBSUpp
TLSH
T19F159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 862KB
SHA256 1954a68b57b10c5f386cdc69ebf185614d70bd9e39271a14e18dee0679ce2dc2
MD5 ffa42c5f7547dd8892f7cc78345669d7
SHA1 c54b2da54d0110a61ed9baa1ad97b54d3b02911e
SHA512 5cd5308bc63ad4069e9a4310dc2967a70a5138a4cc1ad8a0264fc82e4ec324682622fc8826c998d8dc9dd2859f87fcbf531e8fa7d96247b30d2b4480787245b9
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxA0a:A3mnXoZjzyacNVOE/EYoCJBSUuN
TLSH
T174159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 862KB
SHA256 65dc72b16a3f057abfa8889c658dcdff4be557d5664419355bfb12c64af09803
MD5 577d49d3d8d3746ad2c6e2cc175606a4
SHA1 580e7efdc56bf70d8c21a7730d4b3c3705f72975
SHA512 2b0849431e38e0bc6e40bcb6d8bda69581a735718bcc2da653c272301bc203c3a5034a02b7b162424758d23193468ba48374d6b89e10129356a688c5ce5d6f48
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxIF:A3mnXoZjzyacNVOE/EYoCJBSUSF
TLSH
T169159D27EE646CE5D22A89749A918601EB7178710B61D3CFE378C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 862KB
SHA256 605532819917a0bde13e37b5433a3c220c9f238b55bc4b61011ef19b9f7ef6fc
MD5 c7d9489971cabb0145afca1aaf87c132
SHA1 43c7aab0942be26df2ac01dbd07b084e1e1554ab
SHA512 ff602c9cf0b647ee1a9e35f32432e8cfe23cfc922ad2604545677489a13654bbf1ae6ec076484b2b976599bba40007bd6264adbd4a25ae6e462f20b56e24e70b
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUx9C:A3mnXoZjzyacNVOE/EYoCJBSUXC
TLSH
T16B159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 862KB
SHA256 7890e60ccc50e9996b9822afac3bbcbcc2ae657fcdcaf15dffef54a922db39b1
MD5 11c28f915736f0573bb2b357204351f4
SHA1 f7635d5516c4a8e15d368cf8964fff1c1fa6453d
SHA512 60f37f3b3455584baa9cf96b4bcc499d58c3d957bcfcc9594d4df71636fec843e97e32b2857ac48cf6b0c8073332156277ac4d343bc0b8f7b17b446be2f10fc7
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxGw:A3mnXoZjzyacNVOE/EYoCJBSUYw
TLSH
T135159D27EE646CE5D22A89749A918601EB7178710B61D3CFE378C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 862KB
SHA256 32f2b7bcf4882070bfdb8f45fd08b266bf9ba21177ebc43547c51e5ccf821f7f
MD5 171fa06e427e8df0265ce7fb3b7ce95d
SHA1 93ed03f95c03c7ab95152e920af40e03c720853a
SHA512 b004b29dd75be0ed659246d1500a8c3849a4f33de13a7101300b08b4a7d902bd564471709f2fd7dfbb4477c316080b5ab63fb9d4434b838b02aa660813a9b62a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUx1T:A3mnXoZjzyacNVOE/EYoCJBSU3T
TLSH
T14F159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 862KB
SHA256 a972f1da78e5d2af78aa680ab580b201eeb3d9b12840b6c28d90f8114f1fe5c9
MD5 d0b2f022abacf428e62c911a1311f17b
SHA1 6792909c0afbf2f97333666273926055a1b6364b
SHA512 83dd96dc083b33b4194a0d4ddfb73ae4cacee544c08460103d9dffea9ff7bb183cea6ba13acb13a1ea2accd209c858f1903a4944f8b07360448e108a1ac2fef6
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxLu:A3mnXoZjzyacNVOE/EYoCJBSUBu
TLSH
T1C5159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 862KB
SHA256 ebc4a60366d1f47f4bed8c702c33c6f99adb2eb7fd0e66f7a97351e6f0739310
MD5 7daf88f8ef801f609e597c0290ebaf29
SHA1 c3a93ac0a4325e8d5552a97ce5d6e58d255b54fb
SHA512 21a574642bea47e940defc5cc8c62c7661834761ca6ef762a890a040516596f58095de821b3a4fef9f533d8aad6742b569d77857ef171eb0ad2f6ff881591df0
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxvb:A3mnXoZjzyacNVOE/EYoCJBSUpb
TLSH
T15B159D27EE646CE5D22A89749A918601EB7178710B61D3CFE338C3191F237D06F7EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 862KB
SHA256 bbd2ef158778bffccd1d9be15652937579ea7c2e0978d5f2a2b027b6f470e26f
MD5 6c305d6d6e290e48ed8d5b38518bfded
SHA1 9d20adbd0d9b6fa731a6132e1010a5aeef36e0da
SHA512 c38cd045f6ea7e5407e1ceaa62625a94407b885992798b7184d3f9382abd28336fd474611eb8939d04fef574619e24b750dcf367243842b77449ac2fd4abbdd9
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxrf:A3mnXoZjzyacNVOE/EYoCJBSURf
TLSH
T112159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 862KB
SHA256 d041fdecfdc2151591f285ac4624b1227cd2d6fdb1c441dbd8c14cd30e66b7ef
MD5 75db50eceed7ce7f6d87bb534f4745fa
SHA1 f2e7e7a9070663b71ec65b6f0f76e9accbfed6fc
SHA512 09ab6fb4c4525529d6d6b0c54a9f7fadc3dcaeb12217d3fb0c060f808f17402a18a679ca7961183300e587464fbd33234dbeecfdc456d2faf1916473eb8a4156
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxkK:A3mnXoZjzyacNVOE/EYoCJBSU6K
TLSH
T18E159D27EE646CE5D22A89749A918601EB7178710B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 862KB
SHA256 bb580102bcab565479f33efa3956515ea268d5bad30996e45c36b3ab6c708496
MD5 5a51370c90b7a4aeb803352f1b7f4064
SHA1 0c4a4ce57187689aae988856a11156d2627b024d
SHA512 a362678241f2a2483b9529240c0409bc2b92c0f5f1cfd543106d66e0bfb1b3efb11937d26f2cd0900b1cd56cdcbfc4ee9f5218345f68db7f479a341576f3df34
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxZk:A3mnXoZjzyacNVOE/EYoCJBSUvk
TLSH
T1E5159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 862KB
SHA256 47d5e18c37f6e1417cdea76fc9ecfc65c079f3f35cdfa6bb88b5012ed8d05c92
MD5 6877ef43a0e710f78a1441e31b3d8df2
SHA1 29355f9a1619e8932836b085cdd958a8023c0f43
SHA512 738039900fcc9d1a11297d6cc8bf0b53c558ee1f2c96aa237e4ba9a3ef36a947f6ce0a1b6b3a15411a172ad9272491fbbf0fe1787262a742106c1c677d6f0b2c
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxW0:A3mnXoZjzyacNVOE/EYoCJBSUo0
TLSH
T10A159D27EE646CE5D22A89749A918601EB7178314B61D3CFE338C3191F237D06F7EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 862KB
SHA256 113298d59e35f12418c960323f6b693e5636e2dd034454a1ea8b378a59a77fdb
MD5 0ebb6fea6a67beb2819d2d4bc8e210d2
SHA1 ada878453143e79d2b1f9855e799487519af6601
SHA512 2271f8ba4c0c986d6d244a3327091f762ba1ea2f2c323472a71492199071fefa3d767de82be23c0944b66ca53105da3434149582e89addea0e041a3d58c04c03
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxl70:A3mnXoZjzyacNVOE/EYoCJBSUDg
TLSH
T1CF159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 862KB
SHA256 901151ae29df0791e004a384a94c0da4dd13cc0f685760c551cf82c127ed54e4
MD5 2ef31788a747e2fdcb6fbfff7ec7276e
SHA1 5694099d824fb679cb3be6c72cfc35c690d93ffe
SHA512 04cbfb721921136888146ebbd5e96a5cc39f2629539d11d284f3cbac1036c3eb72b700b5202079fdbace820feb91ac9a645288f18eb32038f0ffa762cbc1ef5b
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUx0r:A3mnXoZjzyacNVOE/EYoCJBSU+r
TLSH
T176159D27EE646CE5D22A89749A918601EB7178710B61D3CFE338C3191F237D06F7EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 862KB
SHA256 441b2b1f99911861f7550c1d496d8d281b20587209ea99a36a6e1c1429acc7f4
MD5 38992479b7ec373164d73f8b7f446250
SHA1 022cc2d0976eb31a3437d5bfa242e4f7cf77536f
SHA512 874020443c7e0e184e7464219139ded358089f2d1a7095eb956df5cde3e80611827a3108e1734ef2fd174dc087df89dc76ff859bfde6ce1d827a9fadfe4aa578
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxKn:A3mnXoZjzyacNVOE/EYoCJBSUkn
TLSH
T1D3159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 862KB
SHA256 1802e5485faf71476e5e57ddee92b6bda6dc92ecdad76b1777a3a766f3108556
MD5 09dd46eafb2eab949a387ff271a5c5da
SHA1 4e2a49a7818a53e51accb62dc615e94d73e5fdfb
SHA512 71a9307f1a2785899ba37a2e6595d33272e85dcebf7c5950525540d78d81f07b2aebdfe8e606a5295b3ce653c24a25c4a85691d14d50bcc2e943a407d22249f7
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxAx:A3mnXoZjzyacNVOE/EYoCJBSUyx
TLSH
T1D8159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 862KB
SHA256 1dec88ecbfa9f282a42bcbc2fc25dd873a613a693fdd3bf9e3a142fee3ff1347
MD5 424c863c851c52e57fc1498459cea04a
SHA1 caf0bfccbd9242a7f45b95378c85b7b0639a7967
SHA512 3450fac39475707174c08718b5aff6a0a5556c768f670312dc44ca22b2057878c5d42ea0eb441d79333dffe8daee833d65db2307dc3f294cb497625dce8d280a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxCA:A3mnXoZjzyacNVOE/EYoCJBSUEA
TLSH
T12C159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 862KB
SHA256 204542cd1d114e92f0fe4b57fd64da69f8673251055b647f91174afa775f07c2
MD5 92cd7687514bc8f8e033e2100ae7dc21
SHA1 1f94108e2eec33fcf702a9ccfb82032b1aef30ab
SHA512 cfcea252cbe94bd29f828e634590a72086400074e573128ba7d657d03e419118d406bb9d44a48df03211004b548256d423bacdc6608f7bfeab587669abd93b51
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUx79Q:A3mnXoZjzyacNVOE/EYoCJBSUt9Q
TLSH
T167159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 862KB
SHA256 615daa61950008e966ec81b4631abaee46ae26fd8499eb9595d4c5a4af13231e
MD5 3242cbf6f734530b0de38774df55318f
SHA1 720164257dbdd1050e78f11bda29ba2616198bf1
SHA512 3f9cd1d1eca048f38232000725d61efa0fa5918619366b76c1b1a7f8b6e8be83d20ffee4b51b9310c84ec0e87a33a563ba8491be2e5d760da5660cd54ec82415
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxK4:A3mnXoZjzyacNVOE/EYoCJBSUI4
TLSH
T10D159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 862KB
SHA256 1d95ddd7cf980b0bf243b4bf040529ed224e1a62cfbc87b8596fbafda267e8a1
MD5 5c388d25f380b898ed220e07ca6ab1b8
SHA1 7024822505fee85fa997081e66cb80728c10e007
SHA512 6b87bdc8030e1c5beadc522f1b431b3ce716b027ea01b6b64144ee057e9e82113df67ea3cb856c4955a26bc3ea20a96c9c63a6a97ce150ab564e110c85aa4a00
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxRu:A3mnXoZjzyacNVOE/EYoCJBSUbu
TLSH
T185159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 862KB
SHA256 d8529a358665a9f51c5cd6734eee40e29baa2df3b7e576a20d59adcdc906c30f
MD5 1604be93d57915b6dcc2b2e6f45481e8
SHA1 fadc7e7cab29b4e94eab5c60b864f0ae97d5c511
SHA512 717275894eb66ae776f0136a7f9f45dfe6968f46aea581e99a8ae116e6b9dab6f83dc022feeaba5fd93593969edbe0e9f279b9a68a1121858c7803d8bd512871
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxkj:A3mnXoZjzyacNVOE/EYoCJBSUWj
TLSH
T160159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 862KB
SHA256 3dfd5eff2ebf988c0f45342c3d32c3ceb33c5cbfdc5e822abf6395768eb51f63
MD5 cc046b31fb227d7fe4a63b8d5bc2aad6
SHA1 661edfe1432c68e34aa6a4b912bd356a6c9f0039
SHA512 36e9f12465ff0c97c585b4e0d824d10f3d019a66b297096ac6b413028ee53d1e91cd7831654a5d179dc6207d46c3c7dd2e9d2aba56a25a005fd07d45fb48e5d7
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxFg:A3mnXoZjzyacNVOE/EYoCJBSUDg
TLSH
T133159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 862KB
SHA256 7be83a2aa258de1a10a73306b2f48942f0de1e63e8c27d2d31d05e6cb093a1a9
MD5 4c86181cdad190a37ba64644c4f9ae8e
SHA1 b9d62bba42242909d1c8672514ec43d6db9f10a6
SHA512 a4f08a93fc95e460a1a974ccad05ef5c337a8a166f12272965f696f9ace4cfe4c7465951481f7f04e4922aa73a3f4d50119a209dc09f289ca18d4a6011d76eee
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxkI:A3mnXoZjzyacNVOE/EYoCJBSU+I
TLSH
T1B2159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 862KB
SHA256 dff60e8037427fbcd1b76dda4d5171c0abea38ccb7475e0fa1c8bb4525b8d1e3
MD5 5ae74bb050e7b82e02e1ff6f5afaea1a
SHA1 35827fda906d5ced2039cb3fbe042b3bdbeaa77b
SHA512 5e5cf1eb310b60a7557dd2d2b47c3a83968cbe5ade0564ea22b1891cc11a79151f3cbf33d9a3c8ec72080dccaa4818f547eb7340953a99f5ca1fd4f044bc0ab0
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxWo:A3mnXoZjzyacNVOE/EYoCJBSUMo
TLSH
T1B1159D27EE646CE5D22A89749A918601EB7178710B61D3CFE338C3191F237D06F7EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 862KB
SHA256 20491adaef19ad5eb7d03ba26f9937d44be0d4df453c2b04cfd44fd351ba910b
MD5 088523af7c760573e202da5bf11fd941
SHA1 f7715b62f36e669f274efc5218b6b0536aa02cb6
SHA512 2470c614d4e3907df05656bdb275dd2577fe9ae4e43b86acbe229ab507fade7aa8d3ad67751220dfe84a812b543e0c8f9f1e92bc8df63bedca70de630cf93f82
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUx9+:A3mnXoZjzyacNVOE/EYoCJBSUP+
TLSH
T1DD159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 862KB
SHA256 6343ee7178fca2460153ec02781c5801d3e65c8395e1a34aa0e34338d9484132
MD5 dfe9ecb404b488f831d5e7f90825852b
SHA1 86b43ff455fd4c336e3579d3e48b74d7dbf28899
SHA512 0693f9d7c9dbaab8c68c11f0ea7ba4c4411710768c74dde5540545a4eae0d8ddc548eda740e096e996e0547a01c6a03f554ffc4a111c35256fb23f5b24bfac78
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxrQ:A3mnXoZjzyacNVOE/EYoCJBSUlQ
TLSH
T14D159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 862KB
SHA256 54256713784c6c27b9751eeea80880ed380b8a64b2a6a96eeb0875af049a5678
MD5 683503b61dba51897deae39708fd536f
SHA1 2d6395bdf147b73adcf144ab689d6acaab63690a
SHA512 359a0ca9e595041d96d8838bbcc2fdef7a3b01ef2b1bbd729ef38e08471faa903892f0cc0fe1c2eb483af1000560898121df6d20bdde93e5cc148a8e408dbb62
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxgX:A3mnXoZjzyacNVOE/EYoCJBSUqX
TLSH
T1FD159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 862KB
SHA256 a5d53a0879deb8db3897063a12fbc93d0313a6e862ce74116b897442e35df804
MD5 95734e9bba3ee29438110fc58883a030
SHA1 189cf7860475e2a25e24e5e26c9ca78be58bd804
SHA512 7a8b341493a7ae0782cea37d776b09297117cbe7d736028fc0f396494343d935708d1f632644fbae6b5a5a6a3e0c6f59602b8ba85a4fd8b7a0834e27172e38a3
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxWL:A3mnXoZjzyacNVOE/EYoCJBSUML
TLSH
T141159D27EE646CE5D22A89749A918601EB7178710B61D3CFE378C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 862KB
SHA256 6559a2cf64167b575a18a2023dfa3a847037bcd20b9cf2e43936fba2a6e0f48a
MD5 e12d26255d7be5a8a2f2803d826e310d
SHA1 b448cbebecdec5d1ed3f932a53276eaa734f72d5
SHA512 483bc84840ca3c69e0af8b41c59103bee261599de9508ee7869bc7382d2b2b3fce36381fb3e2204945f4aa9586a261e7326aba99ee7594ada441b96395019b95
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUxqFC:A3mnXoZjzyacNVOE/EYoCJBSUIM
TLSH
T130159D27EE646CE5D22A89749A918601EB7178714B61D3CFE338C3191F237D06F3EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 862KB
SHA256 715eae80d533c3c798f012f489ee67ae9e292b230ad9cdbc02eaa9e40c30e186
MD5 23d05c973e66949b80d396c49643e06f
SHA1 0adc52132f959e100bea69c020035db0c1211349
SHA512 0be6d82ad20fcc2f014740f3564aec3a7a61381a9d8e0837d89fc0fc717489a96dd2ceba6111b222b34938660782df8142545dc90e3df99403e5d4f5edb4ac85
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0BoC4OUtNUbTvSUx7h:A3mnXoZjzyacNVOE/EYoCJBSUph
TLSH
T1A6159D27EE646CE5D22A89749A918601EB7178710B61D3CFE338C3191F237D06F7EA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/880-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4616-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4616-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads