18967041fef2f0b57ca7eb23d6c595ebe3ee3a516c7ff4ede6725a1f80457eab

Analysis

max time kernel
108s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 19:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
Size 948KB
Sample260728-xnylcstckd
SHA256 18967041fef2f0b57ca7eb23d6c595ebe3ee3a516c7ff4ede6725a1f80457eab
MD5 2ee9a2f655f47b26ec3bd86523e1e0d1
SHA1 0477d17bc152a632096c2c19fbab50e0138ba87d
SHA512 1dfd9f47fec7d9db3aea70530420b85cf0f00a8c64a7a95d076c855e757cef0f68f51ae9eca10853582697f78c39eda9de4c5e6fb1daab5b24a62abf045c16a2
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdF:A3mnXoZjzyacNVOE/baEo/owJIUDdF
TLSH
T1F7259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4128-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c51e-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001b2cd-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4128-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5112-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f9-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-424.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a59-558.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-613.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-644.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-731.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-769.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-799.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-848.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1087.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1167.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1335.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1360.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c51e-5.dat	aspack_v212_v242
behavioral2/files/0x000400000001b2cd-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f9-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-218.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-424.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a59-558.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-613.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-644.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-731.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-769.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-799.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-848.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-932.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1007.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1087.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1136.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1167.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1321.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1335.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1360.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1380.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5112	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\7z.exe	2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4128	2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
5112	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_2ee9a2f655f47b26ec3bd86523e1e0d1_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4128

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 948KB
SHA256 18967041fef2f0b57ca7eb23d6c595ebe3ee3a516c7ff4ede6725a1f80457eab
MD5 2ee9a2f655f47b26ec3bd86523e1e0d1
SHA1 0477d17bc152a632096c2c19fbab50e0138ba87d
SHA512 1dfd9f47fec7d9db3aea70530420b85cf0f00a8c64a7a95d076c855e757cef0f68f51ae9eca10853582697f78c39eda9de4c5e6fb1daab5b24a62abf045c16a2
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdF:A3mnXoZjzyacNVOE/baEo/owJIUDdF
TLSH
T1F7259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 852b9075de8e59d9b362b6dd2bb8067365c6640c2f9c75f1f1eb5b260ba0adab
MD5 59f0006502b9f8a2a24ec8c595074ef5
SHA1 3b5a1fbc27d1b05cf0dd91de7648bf9cd6f2f1cd
SHA512 57047739a012045a4a714e24ca3d14745a6417c55503eb0153772142a20834e0c6ac0b872038a4e962b46d1d4b498d47afe4b188fb6f31be1919dfb62c89bb90
SSDEEP 24576:A3mnXoZjzyacNVOE/baEo/owJIUDdB0Le5ji0hmxNrM:A3kMHJIUnPji0Aj
TLSH
T153656B27FA744AB1D077C4B9CAD29646EB7234521B3086CB9359C3292F237D19E3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 962KB
SHA256 d78594f31d81c5cfe44067dd53a54bbc049c41d51a6ed6c76251aa867809d726
MD5 e4484cfe8b4ff8ee880f423a4007a1d4
SHA1 cb35b715604f0f1ca382605dca89261dc63366c1
SHA512 e3e1e0fe4eb37918322c3a723ff3cda1ec2a73c1b5d346f5d5cd9ec86d23d24e44a5311f140c656b028a842d47b11230c6c90e48a70e94dc5dd1096ac15038da
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdDa:A3mnXoZjzyacNVOE/baEo/owJIUDdDa
TLSH
T177259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 971KB
SHA256 f8c9b896306de18998763ac509b5ed5f641e8bd6f2fd0dbaa7720bc35cb3f02c
MD5 1bb087bced5e90b1d1600854055ef526
SHA1 26207a1ed873b37b0e0ac30666b3525fe179d568
SHA512 15b105ac87da18985dfbaa7d2b1ebfd1de880d78d187900e0db200d0db51881dde97cd4030f8bcc94848739c322698d01e890e7331e51a58c8e618763e6e5c8b
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdi6:A3mnXoZjzyacNVOE/baEo/owJIUDdi6
TLSH
T176259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 971KB
SHA256 af3edf1965a99e0cb4ee262682a2127b9746e55ea3e04d3e96f3c0fc4dc6c834
MD5 98f209d172673baa6fe08e125493f0cb
SHA1 01a7f5563d21a375647df874d6db1d84412aa217
SHA512 a569ca93943441ccd83ea552791225f1b48f8e0a4cd23abeebffc0f2b79d4c0f38572af9da1222d3f99638b0e3f3de75b7750210ba93ac59c95bdfab4b16e758
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDd6N:A3mnXoZjzyacNVOE/baEo/owJIUDd6N
TLSH
T188259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 971KB
SHA256 10c1652b8e2bfcfe1112666626a25f40d206a67a3a73bb544d42682e803ceb00
MD5 4e82cde88566383a737049473778918f
SHA1 99b6595f28ecc2e27488cb6e318e85bd6a4f5b40
SHA512 d3d32a651583b767cd08e1597cf98e2d68e314ea1cc5f3bcab34d771187cb875ac952d482ffb9826fa89df13b779cdd12e938607296fac029fffd224cdd74dff
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdgf:A3mnXoZjzyacNVOE/baEo/owJIUDdgf
TLSH
T16C259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 971KB
SHA256 917036969a494d3e59ce9688a966f95ec370daacbdccca9b70fde697957881bc
MD5 878ef78d9ea61a2401592b303f022b20
SHA1 c51da5108e7a856fb681a05feb3de0d64276ab0e
SHA512 a251362cca615828b2f44a6075cccca6f070f1d2e620c67ab91cdf42728c571dd7e044a71f142bb0f0634e67aa7e6bee21c30c493e6ed23e1fcc30ac7af74e49
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDd6o:A3mnXoZjzyacNVOE/baEo/owJIUDd6o
TLSH
T1A9259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 971KB
SHA256 5013b1f2323c7d5a9c3603ce6216450c9656ed85b4a226294138a655c79302de
MD5 988777a2412abf6ef83fe0d114080790
SHA1 f56e339b944ec53d50a1e09085e9a7f228fb30d2
SHA512 aae41d7cdfc7b2a7fcbaf75211f0054ac43b56f6c7d1723523fcc95434f45b12bf4c132f13bc1ce14c9c05ebf06e2a3edb492dce63e4556ac03a8ec48bba5ff4
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdOu:A3mnXoZjzyacNVOE/baEo/owJIUDdOu
TLSH
T174259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 971KB
SHA256 162f9f5030771c79486f2c82104467c8c665260de40edae35bb576d9c81b7174
MD5 2dac5c7c55bc1ee54c0bb91f4dde3094
SHA1 49b7033a02db3d01775d2490e28a95b839ed34e5
SHA512 7bb1d7c4beda6aea43a115af8bd4ea53c54ed552987531387178accf805f4ac81ad92dd2b3054ba3adbc9c5bd05a85966992ad8b38f52bfb3a0fe55718305931
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdC9:A3mnXoZjzyacNVOE/baEo/owJIUDdC9
TLSH
T180259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 971KB
SHA256 d792b45c833f069433c23d9e356a48cc203bfe7ff1697cb786f7911b27194e49
MD5 42bde813dec4fce82225263da2041ddc
SHA1 2fb61b435323727a39bac0c50588f0b098d8f98b
SHA512 0b4daa95db8761066569dc84166cc41caafd24786176ef89c0ed2fea8dea11f509ab15b94c0977cb552fabc82b50f1784847a239f05afc8c9fbdc3610d2c3306
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdCc:A3mnXoZjzyacNVOE/baEo/owJIUDdCc
TLSH
T1B1259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 971KB
SHA256 0acaed7d36e56193e121baeb54f7b483780e64e18c293494dc51e1a90d9e24ac
MD5 14385a904c8ecb37c13bac675c80bd09
SHA1 64ddff79db0f07bdb18248be495ef79a0d81d05b
SHA512 883848af7861bc05d1bad474de139e6cf88c9e8b74f9a1e61a7a2973204283311625efdb01df5ca388c9998cec3c9931abe2535150053353d15a21e88ac307ae
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdLp:A3mnXoZjzyacNVOE/baEo/owJIUDdLp
TLSH
T185259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 971KB
SHA256 5921bf56dfac96027e488c1262ce34cacc72a5ab6153cab1994314b5a45fcdfe
MD5 3ead6b8a37abc7116e67dbbf524f14d4
SHA1 3480b3ef8406f05b2e002b3cae08985d8885120a
SHA512 64058f9126d8d35978cd723a071c6623690265abc76dcca4ebceb7e5e69747a9a42a5afc30505621bcb265cf97c60435e389a8781b89eaab9237d8a7bd8c9377
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdc0a:A3mnXoZjzyacNVOE/baEo/owJIUDdcN
TLSH
T166259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 971KB
SHA256 da8b3ea43232ce81d4135c16d824de95b787cf3066a2aa95752eb47746a164bf
MD5 9f0b32017966fd455b5c46016873034b
SHA1 698db7e73c518823e72150cf32bf2928c012836a
SHA512 dd4fc3001f9d6c96c5de28157e47b22c9924aa06bdba222c5d2d4e6ce91fae764823446019cb81051aa2aea0663572cf98187015a4a9c06ef533b8d9b2005a86
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdEF:A3mnXoZjzyacNVOE/baEo/owJIUDdEF
TLSH
T1E7259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 971KB
SHA256 f0a8cd1bb3e1425b5966086ba3e5975c1dbfb000fc0c909b16839f2591019eb2
MD5 5efe0999e176f6225679c06d8ca04c36
SHA1 8f4d85563c1dece9061acb77163d3ee93da3cf7c
SHA512 a94cd586cd3811a24eafb058a173f6cb4cf60f1b5d74f7484c09813cf9484549818a415abd646262592ec75eb817c152424001cad5a0e2acce6eb17145ffa5e6
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdhC:A3mnXoZjzyacNVOE/baEo/owJIUDdhC
TLSH
T184259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 971KB
SHA256 40d922a329ca6cee2631df84493ac197a724dbf1c5a5880b4254634f6462e3a3
MD5 27f94f5b68060bad1f8f97fe8820a5f2
SHA1 fcb0eea850d8d7daa04ef80538b545a948943602
SHA512 7038510b0b152543d4735b727dde0f39c25451cb36fcf49793bec40a3444e2ee95317d959205a167a9ef7505df097a857538ed2cc48b76d409f1bb97c8d21fee
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdiw:A3mnXoZjzyacNVOE/baEo/owJIUDdiw
TLSH
T1E4259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 971KB
SHA256 d36c824107d5922f0149d96b3e444b775f6a4239c7fb31d8223627449ea881d6
MD5 44638a4a3eb0e743456971bb666b788c
SHA1 90ee371fb20b5cb6724679dfea75a79c99e60a66
SHA512 ff9e5642106d6f6f3cbf47729985ac8bb2ebbbbcf6bd3465f28f41249220855493102adf895cda0d7e2312ff937dcdc48dc0654f7d447adc1e9f7d0a427b325e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdpT:A3mnXoZjzyacNVOE/baEo/owJIUDdpT
TLSH
T1EF259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 971KB
SHA256 6b95b3619b03d1b86cb99f7083c0e68db6d8c329a4b0459c32e6760c7cee5a82
MD5 d484103a1e2113cf63cdf2620a7a2ccc
SHA1 fcfa958760d6d9aed8c2ea9dec0dbff88454d762
SHA512 11f767b25c3907ae188a8e49eee6af5019b203a9d1fca5ff11eca88cdb9023dd86647bdb14d4e1c133d611c24afeeeb40bec760b23ad627e23edef5733cb6360
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdHu:A3mnXoZjzyacNVOE/baEo/owJIUDdHu
TLSH
T1EF259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 971KB
SHA256 dfb07ccef8e8c252d176d65f74eb81020eafb60439f3caada6f1a51394f36aa9
MD5 b0d96b2fe979dffb9d15aa809d12362d
SHA1 5a7b6bda5f559debfb76058fd5a9e6b328292926
SHA512 0593568f23f3b79cc516b2ec82ed93bae27254d3c40a38059ed5decd56cd8943a62a10cfbec8cf6bd293184772832c1e8e518c6ac50f33d9c81cb9c1bdb8a85e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdbb:A3mnXoZjzyacNVOE/baEo/owJIUDdbb
TLSH
T103259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 971KB
SHA256 1e8055aa570c7580978366f47ca76b7914492f91261a2d620812630858215009
MD5 e6eab8573f6c82e7e983bf8b1e8fda66
SHA1 e7f5cd660143d4dbefb3a62fe7dd2a05de26e29a
SHA512 f5b10fcdb505e9f5c20444fb64cc98d567c8fc8f1e80e336c813be50238b6b407c756d16d9d0af5cb0a340a3151deaa4d30418799aea963c6662eede45067d50
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdvf:A3mnXoZjzyacNVOE/baEo/owJIUDdvf
TLSH
T148259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 971KB
SHA256 ce52fdb37c21a3dd4c84f45c06bbb8b02a0adc29564b697e386a58027702d097
MD5 f11553fa271d96f41d7259c03e604ade
SHA1 9747916567e2fe4dfed34d2959da0bfc28c7d2b2
SHA512 685f8df3cc1606a4a22cf5c3a0d4a0b42afe4732dccb1c5deac654e25d438cbb1be0e590cf15c59f794b3aecd4f2bf78c56101957cadfb25d7cd622698893285
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDd4K:A3mnXoZjzyacNVOE/baEo/owJIUDd4K
TLSH
T1BA259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 971KB
SHA256 abbf081280849d2baa2e07788431d0753c1f9b453545a8881edb9dbbe633bdb5
MD5 0713acd4d2327912dd04c0d5bd9bc258
SHA1 c95b04fbcedc3583e92e0ceae1171237c070a971
SHA512 083544742e6e08c5b2a1cb89a774135980438146f1487122e0229f81d39e29e18b6be9d091ece7960429a39a21c1838dc3d177bfd303024a66ca66b46804a578
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdlk:A3mnXoZjzyacNVOE/baEo/owJIUDdlk
TLSH
T1E9259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 971KB
SHA256 fe5c42a997b40e743bd36b24ec1a13b895463a028366be7de345668ca9666841
MD5 c23cda218ab64cd8624dd560c9f44b32
SHA1 adc62aff357fc4c5e8af84e83508584125f4495a
SHA512 f24879a93081d5bfa40532294ddd1e5e563218267d85d35128da4bcff733973350426251d3fa9e099abd8e307a790313f0370e9fae971fd4182fed01867b5677
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDd60:A3mnXoZjzyacNVOE/baEo/owJIUDd60
TLSH
T10C259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 971KB
SHA256 b48d4ccb798ba5749fd26fd1f35d88f790c1c248f14dfa41ed6b8a7bd2a31e15
MD5 d858669b445e10e64a6131dda7f6a289
SHA1 b30b514540310e6e95bad04a6900a067238d991f
SHA512 7eef8cc20568d091860154652bcfb82bcea45a02ac2b5829a89e41b04adab020490ce3ec58139b1adf7b397be09b8cf1dfd63c07a66426ce8406d91343ac4a99
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdp70:A3mnXoZjzyacNVOE/baEo/owJIUDdpg
TLSH
T1E7259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 971KB
SHA256 9d8ceffbedf99f0b8864835b04f2935fe495103e6eaa5a22e5f5509671f00d64
MD5 504ca88e947cd9a0705b2df1051ed7b8
SHA1 704e512c2cb3d7cc498eb7f4d419955cba926adb
SHA512 5faf9a7b6b56ef31d62210196753f74a3a7bff5dc782b3390d65535798db4a749369688364fc9d50627157c052053c372fdf2143a55bd59a207c71ffaa6d5a03
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdQr:A3mnXoZjzyacNVOE/baEo/owJIUDdQr
TLSH
T11A259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 971KB
SHA256 6ed5816648e613b2d6964b07ab89cbd3b219d81a12cdd189342e4afeafde9cd0
MD5 1d107b053460350ba7fb105847eb57cd
SHA1 be0838642c27c8fe74b4bc09c8e3cced2d781107
SHA512 8724ec39620b647fd37fd95cb8c9c6b51acacf84d75d48a9e9949a6e9eb29e7a384a62fbe3e278c5e1fb879d6764ce3a0a274f27c2a41bb4f026406197a1e51f
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdOn:A3mnXoZjzyacNVOE/baEo/owJIUDdOn
TLSH
T127259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 971KB
SHA256 f938ca67970635417054ae6790e2cfdae6946fb7a50e95a1131d8dbd309388c3
MD5 f30e805f7c56af109c051f9a2dc4db4e
SHA1 f1ef8a3d8ecd6266e9acf3cee4fe54d792bf8b8a
SHA512 6d8487eea05a858b2a36d87a71f090ded0bef5bd08389e43ce4f40f31ee8918b8d09439e570a546e877e5cbcca415e4a07b2371ec95c80b02e7d5bdd38fe2384
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdEx:A3mnXoZjzyacNVOE/baEo/owJIUDdEx
TLSH
T147259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 971KB
SHA256 b895fa8071d7d9aed124cc53557e3bed1c0f91c6842caa1bb723a9ad26eec074
MD5 7426324ce397808e0666626fb27a15a3
SHA1 39f51fd8cd1fc7010ee54cdc3200b5bdc94495a9
SHA512 e6fec3635cfbf0cc31d02a8476eb16af82068e2dfa296c77cfcd8091106f5a2916535259368c73960e89e82ad3a7fa944dfe582c9fc4b1d332b2567660523360
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdOA:A3mnXoZjzyacNVOE/baEo/owJIUDdOA
TLSH
T1F6259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 971KB
SHA256 69411d02d35fb3f9d0b75722dc82159a10e5adefa0ee8363afe2788063a1cf7e
MD5 8688a7ed6f7a5e9cc77bcd459011f7f9
SHA1 a014120e3d26fc87b79cc2457aa38038948ae7a8
SHA512 fc844724c50248f77a9ff7249a034ade1514e805e7ad1299536209ea8225bd9765eaf6e97261a3686f2a7b517866be512da60808d170fdfd5d525a4dee999e04
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdH9Q:A3mnXoZjzyacNVOE/baEo/owJIUDdH9Q
TLSH
T16A259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 971KB
SHA256 83d7816e59918bdda3ed7837b69b3e7690e5476e002a48aae08c077822b2857f
MD5 20db4c43d4cbce7a6d8ef32fd6ee1bcd
SHA1 57c0a8c4988d84b570af9eb3d6a7ab5221305428
SHA512 48f84cbd76d23e485d9e60e8bd3545ff36f95c06ea336ca27ef6d07a736b4a87318d6ea5581ffe8ce364cd407de27f55c6589911e444512ee456e4a4732e4324
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdO4:A3mnXoZjzyacNVOE/baEo/owJIUDdO4
TLSH
T137259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 971KB
SHA256 348f51a5b2ef2de3c5f281d740002359da3cc1f7d50b7321d2676071c4d387fc
MD5 904a9cb225e89ef01b0076a5575b1825
SHA1 7d53c4266d95e28d93e5eef7361f0a127c4cc97b
SHA512 838c28954b83dab24e612c240bd445270cd8a0ab47747a6e2bde30f5fdc5a675d02423808b8e38a8bca8f2bebb6dc1ddc65f0d51dd415a4c6f4f8e0b41d4f4ef
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdtu:A3mnXoZjzyacNVOE/baEo/owJIUDdtu
TLSH
T112259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 971KB
SHA256 b271017eea40cc5436fd8af278339018c9a6037072086ba30113d0d132d5cc93
MD5 3f2d3855462da368ffbd15422446ff9a
SHA1 9821576ee1cd072737e74971fe6e3d84ade3d5ba
SHA512 943ea7f39b834e14e77e93cb286e63e768ac52c9dc3992f066b3d665561731d0d189a7179fe7555a26e53323da0786869baaafc09ca678ab7c9d2d9e6294ac8a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdgj:A3mnXoZjzyacNVOE/baEo/owJIUDdgj
TLSH
T168259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 971KB
SHA256 d1379ff9c9f72aa70a80984568f8823813dc84654359fc0202d45b347e38da65
MD5 0a0c9b470a6b4d2aecfe1bc2c1c7037c
SHA1 7e9dc1d23c5265897f225e9610f6cd83c8d4cfca
SHA512 cee344735595ea9986d3e609c2d31bb769bd3c9e1333ca4e7c153a5ab4f53dabfb3685c97ea967a1c30c04b22c2e1c4a9b4b56bcf5d25e608045d60591fbe6c5
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdRg:A3mnXoZjzyacNVOE/baEo/owJIUDdRg
TLSH
T1A4259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 971KB
SHA256 5c55ad938f028eca76cb19bb1b71fa270469174e7f1559635050436e10ddd8fd
MD5 c4692654a6dcb74def87afac96e1b716
SHA1 8edfeca84aa1ccdaf57cf90cfd8c874d297e3ee3
SHA512 559446d73b7b30e933a2afbaadede4ebabc3408c38bb36fed8c4318d92b7998c7db1f3f60d1c17e0d3b58f27eb2a010f9ff85e9ae121e51f3690b4a9edcc9f3c
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdII:A3mnXoZjzyacNVOE/baEo/owJIUDdII
TLSH
T1E2259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 971KB
SHA256 e362fe5d5eeb2c540b38cbb1ca15baf36a7e1390fbb78dd2fc46eac154bda823
MD5 dfeac9bcdd2eebd330c2ce6ada12fbc0
SHA1 e4211c1b0d4ffbae397019fad42d6c3938185671
SHA512 4a96fa8ef2c275ad246f30f1625316a9092ad130ba9a226bc82e87ac881ac989beecc81aae2a7bcee4a10210541104373ec2d3ccd18bc8959f58ff0a8bac9e1b
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdqo:A3mnXoZjzyacNVOE/baEo/owJIUDdqo
TLSH
T1DC259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 971KB
SHA256 2fd93bec34bb5f21be04f4bec00a74ec6e44b1170f1eebdafdcd67ad0693f594
MD5 e2618b0cd4d64b9169ec3e0a83275427
SHA1 cb862bb90cd6c4d60f1438f45d3a8823f40af810
SHA512 8387d0ad75bdffc1168de70a2ed761b2a0c5caba0d8a939f5885aea4c177f921ee06b1f09d6dd4f358dd5b4c22bb416a1c160ee72d267c248990251b9aa34b64
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdB+:A3mnXoZjzyacNVOE/baEo/owJIUDdB+
TLSH
T157259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 971KB
SHA256 c78e90b036a5b7323be71330ec890cea228a120a685a04f7408bb7299b4f7aac
MD5 cba6c03fba4458aa067627902456a5d8
SHA1 45e7ba5e73c1df931bbced71e71207d7bd4c7c12
SHA512 4d70e498b6c3f5162412b2188ddd0329297edc27ea72af089a0b4dc881ae1e1fc5817b0b684a37c7a54cf80adcb5e76d05b61d2cfeb51ce5ecbf704f4394bef3
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdPQ:A3mnXoZjzyacNVOE/baEo/owJIUDdPQ
TLSH
T172259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 971KB
SHA256 a5da2e698b634ca4bfe1773e838c917b04c5c8aacff97aeeefb8e18f158a6dee
MD5 54285168fc8590b14fd702ad633a981a
SHA1 70957a434c95ba780f3fbaec29028f38f35ce5b4
SHA512 b38b605206360f790518cf3fdabaf4a62d6136f18ab7097151fc67440cad0e3457ce268be6579bac7d995256b99eec9285598b58e107d0d662e63c9f27f2e0b2
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdUX:A3mnXoZjzyacNVOE/baEo/owJIUDdUX
TLSH
T1DC259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 971KB
SHA256 bf57bda96100702ca6c14c2247a81d1187947649b0937bdc2e126c846d47effc
MD5 16532f8cfd7fd5483b1b7692ab7a6958
SHA1 2392cfb3b829b0e5d498a267e36cb5dfc39e3f48
SHA512 051a1b38a572f3324d00234a88f05c8d416f7c5c0effee8c90dca76f1fecf9a5d96a4e4302e62d580eeca65baa38fbc75343fe723fedb3cfd11b30ecf4aaf9bf
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdyL:A3mnXoZjzyacNVOE/baEo/owJIUDdyL
TLSH
T1FA259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 971KB
SHA256 756b9f451d0bc0531939e1026f2e64134e3bbda0897450b5f9c97717d61331c0
MD5 a2205cd558fdb52aab8e70a9bf752232
SHA1 b54892a5baa838e8a46f6e71e94dfffbdea6a85d
SHA512 e75108b29a830b72e96c0fed7a208e0f0a9c6e7c036822b106fca5b31630147228382ecc8bfc4a2a88678494fdb8a3e46ec03b64b600b3e6b86ec3f0a1e274d9
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdWFC:A3mnXoZjzyacNVOE/baEo/owJIUDdWM
TLSH
T1AF259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 971KB
SHA256 009d16c42c0495767405b6be5a5356d0094e2f0d5ef21b4948d883a4e2f2f542
MD5 5683aa4323d9367256f50b59624099ad
SHA1 68402e06e4c11d206a19fdfb900bc2eadb6126f8
SHA512 6a431a5607f5a7b460b407778d05fd09e7421d416fc281adba64603d4fbc50c7835b0a4e54e27d7180be17f7f82dc4fcb35135eed2a3724720a3ebb959ccd700
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDdfh:A3mnXoZjzyacNVOE/baEo/owJIUDdfh
TLSH
T1EF259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4128-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4128-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5112-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads