eab8ad98f9d5974e4262da6fd2aa48e146ab18277b23ecd7e4934daf4c06bd2e

Analysis

max time kernel
96s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
Size 924KB
Sample260724-3vy4cseh36
SHA256 eab8ad98f9d5974e4262da6fd2aa48e146ab18277b23ecd7e4934daf4c06bd2e
MD5 b475f0a5507248f082e3371cf9e6a40f
SHA1 749b08679b8625b7ff24224e31d34e16b5d0be7c
SHA512 f958ac941ae198f805f8ebcf44b3fe213628d394aa517d1a8cc29c98f7a389d9c384fde4e2aaab02b12c75c36934bdcd5326e2b3b36b062024ec715d3fb58657
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjN:A3mnXoZjzyacNVOE/baEo/owJIUjN
TLSH
T195158E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 40 IoCs

resource	yara_rule
behavioral2/memory/1132-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001200000001c544-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1132-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1032-191-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-240.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-271.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-464.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001bb47-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000198e2-702.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-739.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-783.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-972.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1015.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1059.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1115.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1140.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1363.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1395.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 37 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001200000001c544-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-57.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-240.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-271.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-464.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-495.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-586.dat	aspack_v212_v242
behavioral2/files/0x000400000001bb47-617.dat	aspack_v212_v242
behavioral2/files/0x00040000000198e2-702.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-739.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-783.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-972.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1015.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1059.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1115.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1140.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1215.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1318.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1337.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1363.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1371.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1395.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1032	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1132	2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
1032	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_b475f0a5507248f082e3371cf9e6a40f_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1132

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 924KB
SHA256 eab8ad98f9d5974e4262da6fd2aa48e146ab18277b23ecd7e4934daf4c06bd2e
MD5 b475f0a5507248f082e3371cf9e6a40f
SHA1 749b08679b8625b7ff24224e31d34e16b5d0be7c
SHA512 f958ac941ae198f805f8ebcf44b3fe213628d394aa517d1a8cc29c98f7a389d9c384fde4e2aaab02b12c75c36934bdcd5326e2b3b36b062024ec715d3fb58657
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjN:A3mnXoZjzyacNVOE/baEo/owJIUjN
TLSH
T195158E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 9829251c553c59c55f61a34534cc8e690436eee1d4fd4f54ad60e763edc44e53
MD5 ef88dc26c9d792bd5985442a6f9c6a83
SHA1 bbfedddf1fda9f4141cf2393f37f9191fbb70333
SHA512 46f14a698723012271b68308169f7e51874d876250b42f39d6c8d23e92ce564935118196fb380e9cc0be831e62e4013333513ee934eb14a312b12168b34b5532
SSDEEP 24576:A3mnXoZjzyacNVOE/baEo/owJIUjZ0Le5ji0hmxNrM:A3kMHJIUFPji0Aj
TLSH
T18A655B27FA744AB1D077C4B9CAD29646EB7234524B3086CB9359C3292F237D19E3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 938KB
SHA256 f1e0a7136cc8d29cfdd875d313134c25c348867b24ca47ee8ba64adb7dc92e41
MD5 126012700d10e03265f682ab93a24ce2
SHA1 d08b4eb2ce095cf1ef3d91865e960372170d26eb
SHA512 9a76501287b9766cc10168b76e7ac9c9252c277159d2ed34bdbb3f0818d06ae25314eeea3e31cb2f0b0f953cd0f481bf42bbd2a8b7a5011a554059783daea792
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjLa:A3mnXoZjzyacNVOE/baEo/owJIUjLa
TLSH
T109159D27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 948KB
SHA256 216de2bab6ff6e15e735eeeabd8dc50fd2b261f8551c1d280ce303b978170527
MD5 b588e251cd0d564ac6a595e249dab56a
SHA1 b9fb2334373689650ec83b72e6039eb9986aea08
SHA512 32c40f074537b468fb675e4bd590f849574bf8a87f44327a3809167a2e18c484de444a00d85fb197b0090550bcf0855e56b6bcc3d4572bcb3619487c1b6cf090
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjK6:A3mnXoZjzyacNVOE/baEo/owJIUjK6
TLSH
T11D259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 948KB
SHA256 bef72ad811fb4cc0e47481ca7732e20d50ad72542ad860eaa753e95f4eccbb05
MD5 26d97a98e96441e0f2aa9d896aacc7b2
SHA1 124459477e00ccb068c8530b12184b5567462413
SHA512 3da41161d717929a5a68fa07e24ffd0d727958e327a44f398f52111ea7edcf79ffb7ef7f16703012b4c0143a754a2e9cbddabd616ad4aaa6dc1e84057e983002
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86Ujmu:A3mnXoZjzyacNVOE/baEo/owJIUjmu
TLSH
T1BC259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 948KB
SHA256 b50d4cce0e3b2078d30a072d8f44345ddeb157bea01435e90c8b0997821cb14c
MD5 6c1bdd3c15e66e0472e9eb2e4335a61c
SHA1 621fdae3d2c9f24d2614686c23e4c4d06f851fce
SHA512 738846401dc5aff3eee9921b2a24e0cf6e4e9a08b2b75ca07a7ceb7e103f6b4f65f1b72ce03d4bedc313c927f98303bda9a512450d6d812a4933a005f1259b0c
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86Uja9:A3mnXoZjzyacNVOE/baEo/owJIUja9
TLSH
T1F7259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 948KB
SHA256 b7c4a51464bf9ebc36ee969779089a1f71692f9afaae734a2139697c987b6968
MD5 82675c05cf26a43969df5df7ed031ac3
SHA1 91101452207524ce12d5371310b066d207b55dd0
SHA512 8b12e3200d51602af14c15c0de5cff3323fcd370025edf7c03ae45949bfb1965ac86f7810b3e6fb8bb7d7fe9ebd6a475469ef63a289e85ac964293e118962834
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86Ujac:A3mnXoZjzyacNVOE/baEo/owJIUjac
TLSH
T1FB259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 948KB
SHA256 39b5b4b04f25de35a9e4c7e06a38ba287e6e838a31ec36a36501932ebec9a2f8
MD5 c659f12bd6a3f5ae2b40de219f6d8840
SHA1 925fb6f56e6febcd1b703aecec748547cbf871d2
SHA512 4bfac8c7db9adf6659fe763b1327941d16b7de58f5ee7bdb8b281b6de7cab3d46ff2576c2b49e35d8e4c4cc7208abc87ade05ce50e96869ba1ea35e2bb00b6dd
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjTp:A3mnXoZjzyacNVOE/baEo/owJIUjTp
TLSH
T17E259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 948KB
SHA256 3ca28e590f3605837eba153271cb826876abd9ae7f7b2f3f2c9f57d0be0b3328
MD5 645957c54c3211aea8010142c63d374c
SHA1 0d9bb49741acac5bfdef0f3bda531bfa27d2957d
SHA512 e99f746181db4e976c20f25cbf2320689d4e379b9745749b63829cbb0b9fdaeaaa03e908a4b403578efdb5ba0eae9461548b34493ae1d969ce64be28c56cc6c7
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86Uj00a:A3mnXoZjzyacNVOE/baEo/owJIUj0N
TLSH
T1EB259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 948KB
SHA256 5ecc1013254e631983b91935a520ccde55a043578169a8fe3d8f0f265005afc5
MD5 282cb706e591ffd6b25df3f3e533f847
SHA1 061dce970b180953ff5f190fa7aa36418facfcac
SHA512 9376821e120d81e49604f2d1ae6d07c9a838fee5fe6493dcd8949be68b4bc535ed01a24b2e8c5dcb1dbe5e16ecb2aa14a398bc551b2a5cddd90f169b1cc04ca0
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjcF:A3mnXoZjzyacNVOE/baEo/owJIUjcF
TLSH
T178259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 948KB
SHA256 36ea2d602d3c04cd5bc4a7ddbc278a32294bb368aef35771a0ee9ea4d78db797
MD5 57391f20975420fffc5ac4698221c723
SHA1 3e5ad1203b669193f3c9700658463741b4dd5182
SHA512 d3b7ba2cb0d0556cf6ab388a51a061f2c6dcbf46d91a1f6387cfd01aeb2a390945d1b99806e6289bd55bc899367b69131addc5a6bf3d3b5de41e4112e963f97f
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjJC:A3mnXoZjzyacNVOE/baEo/owJIUjJC
TLSH
T102259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 948KB
SHA256 c661ed3315ca589a45a9baf1bb703ce01ec53f7fdfad858909687ade190ad404
MD5 f0b2fee35ad351553afb66f184c99d95
SHA1 860196b6a254f76231a122ed85898e3ec41bda4c
SHA512 8a37eee191c29da88e4f676bc9b3f1e59d908481bab60ecacbb5d0442d647d5cd2b0917bb6f4dba5881107e7253f94c620a3d17a4febd370489c3ec76073a886
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86Ujqw:A3mnXoZjzyacNVOE/baEo/owJIUjqw
TLSH
T1F5259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 948KB
SHA256 b37de3d8b15d4c182e26375445075e18507b2f9c4444e94b353abdd5130a2d8a
MD5 701d1f866cc7ffd048332858d59b6373
SHA1 4f5b80636a7844a2008b962cc0bab07c633dbc93
SHA512 2ee74652b81cdb8d04d3e7de68f3b0257c693e2274dc85b04b2273b79c098ba27a87ad9062ff4a0887c6156c5542c955f87d76bfdfc78617a19c7aba56e3a587
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjxT:A3mnXoZjzyacNVOE/baEo/owJIUjxT
TLSH
T1C7259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 948KB
SHA256 6dd07db8f2950704b57304540fe7c9ecc108d9a78f37cdd483c4f30b1f0dad6d
MD5 6b4f50e55d8a8dbf4333711d914e052c
SHA1 e5905331f4d80527818dd9229c054b6dc56b8595
SHA512 6644de2b844d8e4aebde9b4b38c5df701dcd3ece4fafee022fdc6ac4e9eac6cd9990e00280b8b4ad46e68c6be61b27a6c43c1acac751c97114c62eb4c7ed2d42
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86Ujfu:A3mnXoZjzyacNVOE/baEo/owJIUjfu
TLSH
T1F9259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 948KB
SHA256 7521359a1b00b03d90e04d75eb5e1eda75e63643269acee6009d2f79732b0465
MD5 4f314b1989192a468313c6afc7ab99f6
SHA1 acca5108520c69a615979894017d98c729375c2c
SHA512 b07709b452d3d082defb76aafa58c97a612b23708c969cbdfe91ad3ed72118291bfb3c29982891d69931452a85fff83b1faeabca6188656335e68dd89ab9f4e0
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjDb:A3mnXoZjzyacNVOE/baEo/owJIUjDb
TLSH
T1FF259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 948KB
SHA256 a1bae1cdc7460a0c1e426f250453ac891c77888473bda0c8aeea23635fd167f0
MD5 3e028b91bbea78f495cab2ab95138378
SHA1 6e5b3770bd13e48f36b56e5fc7996a61953fe86f
SHA512 beb417259a258c1577f934b0c937d915df9f778ce2225fc87438e3d92bc147c65be3446b9c1f1cae26ab3818856515ffa71e29f8840501c465436efb031eb5cc
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjXf:A3mnXoZjzyacNVOE/baEo/owJIUjXf
TLSH
T134259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 948KB
SHA256 77722b23f00c1f03c3342b7fd82d11efafc2907b553a24c41212eb962f9d8081
MD5 4562cc08c2a97ec7db0cac1d795a9dc4
SHA1 f7ba425076696aae3c9830bf2e671d32a5b69be6
SHA512 b8c13943e2b7c74c940169f8ea52ea399c4d1ae33c6392c719ddb1e622ae1a2f4867a865f43dacafcf95b0f0a2d3165ca3d1f7deb69aae3f5607c956a122f6dd
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjgK:A3mnXoZjzyacNVOE/baEo/owJIUjgK
TLSH
T121259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 948KB
SHA256 063663133eadf14896dae93e2e237e0ad3282c039f90e2935c415ac92c856053
MD5 5186b7d4b69ee5dce1f161ee6a59f0be
SHA1 71344ffbaca88651b3a390cb43e1f9bceea60c9c
SHA512 1ae7682f8b3722d0e30e57ddb75547e66e90fcdeedc0acbf4d9b95371d095d970249c129b1b472131924e939582df6321b89689f83e6c9f27e52f28266e3a696
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86Ujdk:A3mnXoZjzyacNVOE/baEo/owJIUjdk
TLSH
T110259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 948KB
SHA256 59748aeb9969b5d8316e821aa95c0160b96fa81bb7e80879330951919971da5b
MD5 0b97e507ccc52ddd12686b9151a2dfb0
SHA1 7e2057e1d579db2957fcfe38e2058e12001c2fc8
SHA512 e12b3da50e97e3d85995e2548bd993c63cac5841e023f06b134b3d28f8f2ca4702d4e0cfc7b7db8b43ff2ce0d0248c797e1f276f6181440e0ee9c0ed01060c67
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjC0:A3mnXoZjzyacNVOE/baEo/owJIUjC0
TLSH
T15D259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 948KB
SHA256 2059bd8119394f5fe1d182d58fa8b9733642abb831854f28033fa9f68fbd9eb8
MD5 5c2e37c0bdb24f7a3f6221fcc1f189e5
SHA1 49c982191c2084df7a0e0cbabeda31b8c02e8795
SHA512 2ca03a596b99f22687b3ed48941871d51e0b2c36a6d07e2b5148a329d5ca9f536fd596905ebf4458688295ac56a79937379d55be829aec8eb216826bf4ab901c
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjR70:A3mnXoZjzyacNVOE/baEo/owJIUjRg
TLSH
T1E8259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 948KB
SHA256 4b7335e38e1a528386d63475054377755122fcc4c2fa2f1e2941b037d4ef78d1
MD5 c7f127908f1748547088301485f8f1fa
SHA1 bfcb79efb3e71eead089640e3465fbc31faf6305
SHA512 11d81a0136d3924d14187c311529242ed54803f9efe41e23ce3f3c2c1872789de06c968a672ed48d4dff98df2af9043450cbb5fbd886a0d9227874636402f265
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86Uj4r:A3mnXoZjzyacNVOE/baEo/owJIUj4r
TLSH
T188259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 948KB
SHA256 6ee88e32147a557d58f8a478c605c35a2d49c9962b3f0ecbb1ca06aa17c6d4de
MD5 95b5385685c6129e83c33295702c7fa7
SHA1 c7d8658fd02e7ec645523d0675ea213daa451d73
SHA512 839ed514b3c0a18f096edf2d5966d704ed1b4bd792c66a7c8a7bef40f35e57217aa28a9985797da85272512063bc12f09290fb62298a01eca43906a0d48c33e5
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjWn:A3mnXoZjzyacNVOE/baEo/owJIUjWn
TLSH
T100259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 948KB
SHA256 8b9d3b48afc889fbac200bf2f31913508ac8c6f74930a4d0b539ef82c6b5280f
MD5 1bce3d88747630b72f1ebeabf7b7c961
SHA1 e2f6b14cc799b9fb28d055d2feba1e4571d98c59
SHA512 5d6d0bb7e6b5d53d7488ec5f7faf3ac00a0e8969cd846a32f12ad5ac165b79ae54044be85a8094441ff0272d9c77192f0e5604bbc08360c28518d3bbf011891f
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86Uj8x:A3mnXoZjzyacNVOE/baEo/owJIUj8x
TLSH
T114259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 948KB
SHA256 12d6242d91ce5f0186cf3fe51f98a9e043032bbe55c6ef84c96e038d79bd60b2
MD5 8667bdc078d0cbb2b1957c3cd58d52d3
SHA1 4ea0878c3e3cf31bd9525129d767eae88df03455
SHA512 6b8e6c725c29fc804a249d8eef2b39cda05aec7b47e09aecfcd4063fb90bc3f70e9d3e7959033ae3ee416c3ae1db30aabfd32c3488442bbf000be03a26da520d
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86Uj2A:A3mnXoZjzyacNVOE/baEo/owJIUj2A
TLSH
T1E3259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 948KB
SHA256 ce190f4b735edc74e92310d0910719072419c07aa3967d6c90d29df406c5aead
MD5 9469c4ee833415456d29424e833ed7d2
SHA1 13d58108a1fc5626c5b3569e439157865a4e37da
SHA512 02b580cc60ed0f52be5233ef52b13c941fed131c170ab747004adc8e0a5e6f745cc632c1243865b5a30850b5bffda4f5bf0d08b4954af3ce21c7dc99becfa072
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86Ujv9Q:A3mnXoZjzyacNVOE/baEo/owJIUjv9Q
TLSH
T1D3259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 948KB
SHA256 cb009aede901154da8ee95d0648491e8bff6a5a0e5a25ac6a4b37fd403201f19
MD5 a0580e87310a0de9b21b6cca9fe226b4
SHA1 34663c90a214e01f62bfe9512397cc9717af02c9
SHA512 0dc25d9a23ec2cf3dcc8bc88bfe0671260af307a154f6054622b079a0ed135c4c7d7a82233bb4d8127ba646d2cf546c078cc9ee8587e707ae06981cb90384d1e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjG4:A3mnXoZjzyacNVOE/baEo/owJIUjG4
TLSH
T106259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 948KB
SHA256 d366b1558e9be105b6ea98079c806a7e7330314d424f7f8d488f4ee9bb65493d
MD5 fb12791a53d8bfa10f074b66a9115ad4
SHA1 1832757183629b40644d4d8e97eb513b4bdd538b
SHA512 01b25e27516a6f2bab60d7392410d635f9a636bb89b5cb7235c08dca76561fd4fbf0cce2e201cabeba24ffaac71166cba8e76c53803045ac47592644d9f586e5
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjVu:A3mnXoZjzyacNVOE/baEo/owJIUjVu
TLSH
T1B8259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 948KB
SHA256 5ce12804353bb4b230cda0588a83fb1587bc39bc82e822d53b31489d1048d0f0
MD5 df569c561d3bbdd75e7fcba39fe56c61
SHA1 b1ca3db7107aea166f3d837961ef9fd39cdd9491
SHA512 6fd766055e94cfc5bae114091cbe347fecbc61d14c2d3f588feaedb12ec39ede58d21a2c493c06f2c36e957d960906f39e92298cabc183b69fc13ec78de95af5
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjIj:A3mnXoZjzyacNVOE/baEo/owJIUjIj
TLSH
T100259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 948KB
SHA256 9752e84562c0067bb11887075f17ef9ed8ee17093169afd819b5f6de2441929c
MD5 ade288ed909c5be8222a0b66efc25954
SHA1 3004f3199b28682cf8de499494747d04c89f7590
SHA512 804a4244c5d31de0a6b5832d19e7b089164ab8731ca27f46b63a21e404e818a94a8b76303d67ea1995fedd3584e1b613d37b99e4077388a03708378f60da7bf4
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86Uj5g:A3mnXoZjzyacNVOE/baEo/owJIUj5g
TLSH
T1D9259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 948KB
SHA256 35bb796f235753304f10e721854504e407b450c9bd7058f3feb4574a00d4fe55
MD5 faf5cdbbc3779e61ab432273262bff2b
SHA1 02094c8d063b2a5110edf0f349f41879879a6dfd
SHA512 36c7291934ce2e996fdf01647acb73b0a893a870a3cfe30c6f7e7286814fc2c9668f2ee69344253aa5827d0903acb3c2c76dbf91535da56255c66e8d5fa338ee
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjgI:A3mnXoZjzyacNVOE/baEo/owJIUjgI
TLSH
T1CA259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 948KB
SHA256 c7c8841c2e529d6988a16321021456f4a07c0410bbf3a9909898c8ef1993b6a8
MD5 8518d2a2310cb3c6ade6a0d7761ec261
SHA1 196d6aa773c6fd5915634015e5c1cb0e323b3518
SHA512 4fb2eeb4203ae9694b1f34142070010238c94a798170334fa9d656d4c8a641215584228f90c315556d2048c6b5d11f232e076fe2473b43ac95a17eee9e901f90
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86Ujio:A3mnXoZjzyacNVOE/baEo/owJIUjio
TLSH
T18D259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 948KB
SHA256 47e07da574b9a7d99a3180323b6140210470486440ee4b5dcc656e51051fd78c
MD5 4a78f455ae74f5a938d51daddd607010
SHA1 e746943c6c026ee3697b96292aa4da89d4cd1c35
SHA512 afaf58d9a1e1bc850599d0398175b27a6f0dcdb36140ff3a4307cb230d5014d096d5149a838ae677319b217892b853ab7ded8a34cb1f43b675d6f061413bd2f9
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjZ+:A3mnXoZjzyacNVOE/baEo/owJIUjZ+
TLSH
T126259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 948KB
SHA256 8f8d0d9c5f561c563a850f130c98874e804e53b30d872f01e76003f4c51c66b4
MD5 ed257254d1fc7e571c887b046e2a8b31
SHA1 22a63f69b1cde4827bed089c75e08d019b640f64
SHA512 b4e69198a6a617e1bd12aec873685bf386379d916484be81c14aa16eede855b6057749b3d83be6ed547b983daeff4680f474c5d6b1a85840be79bea470defac9
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjHQ:A3mnXoZjzyacNVOE/baEo/owJIUjHQ
TLSH
T1C2259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 948KB
SHA256 1b5a0ed889b6f97e99fafefb3de44ad418ee696267a66e8e5dc0b407e93c6a62
MD5 7ebd924a125d7a55330eb850d7af70ea
SHA1 bb57a83e441cda9b7bf5c44670a2b5c50451c2df
SHA512 f43e17c01e40ef7211c4c5e5d8cc853f3cde90cfd9f0b848d4b65e4415cfb20c6a327e8d385aca9dd19b41332a1acc2a04f4100fedd39747b834f51ca2909a98
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjcX:A3mnXoZjzyacNVOE/baEo/owJIUjcX
TLSH
T1CA259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 948KB
SHA256 b7deff811825ff3c27775a4004371729bde17f6599c62db36111fac2af3a0f94
MD5 f2ac12674ea32c6b1649b28dbb72b9e0
SHA1 3a630fd5c3fb650521250bac0939fc5e15b884ac
SHA512 3a5cef86f02f9744c9d1152540a27c7da0e5cfe27fab453e27444bcc1ed03515236ddf1ff9f9bd2d5712195843c1d4185731e0f879d1e5ae9a1ac52b1edb5acd
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UjaL:A3mnXoZjzyacNVOE/baEo/owJIUjaL
TLSH
T134259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 948KB
SHA256 e75cc50bc5297e7682e54c81d2cd87ee3ef9327db8ac4b51df10ed2c828f7ff7
MD5 587d41785e583e9bf491d6fd888ebcee
SHA1 f16f14da442e85f92762a90a52a12f3f5d82aeed
SHA512 a5b648f80273ece1c5ed848cecdd1289adae3f307b4dea8d366eae89f9642e2fddae461975817543313e4e7344d8154fff2b6d5ed81990f811971044aea8fcfa
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86Uj+FC:A3mnXoZjzyacNVOE/baEo/owJIUj+M
TLSH
T14C259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 948KB
SHA256 393a0f4522117d62595de5fff6e25768df81eb40d47baff7b3e1d4c1802944cc
MD5 949492629d6069a50dce8e1ddeacb650
SHA1 418b9e52ae1c0fe1df221b6525c6e6473826e0d1
SHA512 ec4c2724702e72a4a05c976f223c0619ed84ddf1e163d062535d357116637ed91bd1197c7ead8802d2b07c5dd70eab67f3ffea590ac6a9e1dbc83921eef9a27d
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86Ujnh:A3mnXoZjzyacNVOE/baEo/owJIUjnh
TLSH
T175259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1032-191-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1132-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1132-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads