2b56aedb510ed1d79a3dc393ca113a5dceadb636846131391c8cb601e38c41e5

Analysis

max time kernel
102s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_bd6597cc7151bf0823df958f61753670_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Size 939KB
Sample260729-ydgersep2w
SHA256 2b56aedb510ed1d79a3dc393ca113a5dceadb636846131391c8cb601e38c41e5
MD5 bd6597cc7151bf0823df958f61753670
SHA1 883478602ba901695a4a5a8b66093aa3936e52fc
SHA512 62593d2036a1c47012794ab16224480c68db8ea19a3fb310f9cbd2be12ec45c905012ff8c1ab53d6c984058262832a374893f8e2cf7f6043cdeae735e0030867
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2Zu:A3mnXoZjzyaT4aewsAjxTcgNaB2Zu
TLSH
T19D25B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/2028-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c538-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2028-76-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3280-107-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-490.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-576.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-704.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-924.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-998.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1060.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c538-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-490.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-576.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-704.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-735.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-924.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-998.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1041.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1060.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1129.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1217.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1326.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1339.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1370.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1379.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3280	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-29_bd6597cc7151bf0823df958f61753670_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-29_bd6597cc7151bf0823df958f61753670_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-29_bd6597cc7151bf0823df958f61753670_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	2026-07-29_bd6597cc7151bf0823df958f61753670_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{9A8DEEB6-1F0A-4CF4-BD83-A8EC662094A8}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-07-29_bd6597cc7151bf0823df958f61753670_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-07-29_bd6597cc7151bf0823df958f61753670_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_bd6597cc7151bf0823df958f61753670_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-29_bd6597cc7151bf0823df958f61753670_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2028	2026-07-29_bd6597cc7151bf0823df958f61753670_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
3280	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-29_bd6597cc7151bf0823df958f61753670_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_bd6597cc7151bf0823df958f61753670_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2028

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 939KB
SHA256 2b56aedb510ed1d79a3dc393ca113a5dceadb636846131391c8cb601e38c41e5
MD5 bd6597cc7151bf0823df958f61753670
SHA1 883478602ba901695a4a5a8b66093aa3936e52fc
SHA512 62593d2036a1c47012794ab16224480c68db8ea19a3fb310f9cbd2be12ec45c905012ff8c1ab53d6c984058262832a374893f8e2cf7f6043cdeae735e0030867
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2Zu:A3mnXoZjzyaT4aewsAjxTcgNaB2Zu
TLSH
T19D25B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 d956f3e0f423d59f3da798065409328fced5146cf8e390f73ce9ca3906b36628
MD5 8e9d11dc01cabc693b224ab7f3496219
SHA1 0ff2873d2b78e184b82a6a6314bb82bdf7ade9d1
SHA512 45369eb3c8b492d60fd500b6202ef2117a7211ed5aba3059d4447c2866e4f008903a887bf93f0a77e76606e63f90fec999c7bf56abc11ff38cd57c9720997993
SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTcgNaB2Ze0Le5ji0hmxNrM:A3kMPljgPji0Aj
TLSH
T1EA658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 954KB
SHA256 f5d56df026593820a137776e6cd36bc3b54308f79e02be7d974f3c26b8aeda40
MD5 7b67b3d6620e6acfad20bdd37b2c89a3
SHA1 9d019662b31c08122a3f9c81fd047fc882064ea5
SHA512 5e20f1c72aef6c655af8d537d7ee6e52139e3447ee7aae6d4918b5241ead5e8857b10cfa8e91eaf7835d21b5c7d2d19148a7b719faa9cacd55671e4ee8407a03
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2ZYa:A3mnXoZjzyaT4aewsAjxTcgNaB2ZYa
TLSH
T18725B023FBB090B5D23B49705BA58713EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 963KB
SHA256 99f1ddb73f49d4fa2d43e0f0de48bc515f86a3013f5af4f6a0f1ee77ab1a8443
MD5 c67d2f21a36d572b0a975036463b3068
SHA1 108cdbfdad9d1e7c9cf160541f6fb5acf18b4696
SHA512 74d0aac5383fd0f611fa9aeabaa8807a6aaa4694fd31ac98dff534eadce7b51019d6a0fb69fe7f8992ae12f1e86981fb50ee2da6ad0e28441b19e81a4ff5777f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2Zx6:A3mnXoZjzyaT4aewsAjxTcgNaB2Zx6
TLSH
T18525B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 963KB
SHA256 650d7c061fd9ce631edfe9e015f3fe6f6f03e7e3d2cce3124254ebd2a82c7b73
MD5 71868372ab5fbb11e37342776dded213
SHA1 ab51d98f297b705662e482e449f9e4b115bc5bee
SHA512 01c4ba65e38f4f00d4d0a1cb62db740f7d05b6e884ca43d4cfc4f931922a2e224b71c64f92ea650280158f988597893bfa1c40889306ece5f039927f48f20ee4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2ZvN:A3mnXoZjzyaT4aewsAjxTcgNaB2ZvN
TLSH
T16125B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 963KB
SHA256 7a81432d651ef25ac2e971a498baa4c7b99fa6bb3e582b3899698dc3232a26af
MD5 c0cdfd0fe64e312bf38adef8fdbf0955
SHA1 529a1d5c21d87d25085ce81115a16c9a4c599583
SHA512 5501e9737e42dc7207957fea95c6d065040f5c9d4a4ba19ab9f70db7284cbec3a67edb628f051cc06d0f819ff973494189592bc20b6e9ff782dd42140d659faf
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2ZVf:A3mnXoZjzyaT4aewsAjxTcgNaB2ZVf
TLSH
T1DD25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 963KB
SHA256 dde3ad5b46a2b02a29c560951d5fe546207072c41003c38ebea6571e5e5dd32b
MD5 8aff00f32c949e5afca1cbfccfaa8d02
SHA1 aac96035d440829f8399acab7048d1427ba2e6e4
SHA512 1d9c157b63b265569124e7ec7d255ddab6ee472b79d4cbd1dec7aa17624b81c36d7380d8105dbcbb11e65277c6eb571b9690e4e039c51634a7c9aeb7843226fe
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2ZXo:A3mnXoZjzyaT4aewsAjxTcgNaB2ZXo
TLSH
T1EC25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 963KB
SHA256 a3a5357b2f585c41ff571960dbdb8cfd4ac6a1e5e68e01257569fa31a54bcbfa
MD5 4532618b89af65dcf8d0bdc195f65239
SHA1 e1922c56385e5f291c411ba4ee87d5fbdb1cd76a
SHA512 93328f8bb1628a46969b3b8e5800cf92471b949c80f5b9533a38152029a36af8e4b148372b5a242d142c14123cf8632be9638bfa017a85469c1d575ece5348e5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2Zbu:A3mnXoZjzyaT4aewsAjxTcgNaB2Zbu
TLSH
T10725B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 963KB
SHA256 3aaf7f330a5050cddcaeb3a0040f0d0b28b5b791872bf057480ba9c9d07c0af6
MD5 29b793435008052b05299c062b40d6b4
SHA1 39482a0f7e8f93ea36df561a2a06c3d23b62a586
SHA512 36766e6020f01e338f071030b8350b110f6dab246b9e40a721b3359cb9f370c5a7bf8b1c3a80e434d8ab841e874f8718b434ab7c01294e303d8467ca6a8d4455
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2ZJ9:A3mnXoZjzyaT4aewsAjxTcgNaB2ZJ9
TLSH
T15F25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 963KB
SHA256 d801ae1d7c7775646cbf25d194738dd641b35b910331aa0464c4a1bee511644b
MD5 08da3a5dd5361370d067ffb3d3855eb4
SHA1 4faa1656cfd4368545869f45a347707f5ea161f3
SHA512 ccab07147923cf15f672d92a4e0489fdc9036aa621d042b73fb5cd0cdff385ab38cb8cb66b5b2501212e5f1d768e2bf3ce2048ae3b738ce0308656ff60e1c622
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2Zlc:A3mnXoZjzyaT4aewsAjxTcgNaB2Zlc
TLSH
T1B825B023FBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 963KB
SHA256 a068d5c15fb6e32767f68501d247013ce405bdd88dfc7535e4d691d82867ae13
MD5 a7b962bf2c4835f6eb78e31f398f6f04
SHA1 830a402eec1261becff44bfb86c8f10a7f510a15
SHA512 956cf5ce2303e6d190c130b706d78f7528e299aa2687be95799290bb633c6de8db446052738860d92b626c5c4bd5e7c57dcd7dbc96d2dd00ee51cffe26bdf6f6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2Zep:A3mnXoZjzyaT4aewsAjxTcgNaB2Zep
TLSH
T15A25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 963KB
SHA256 a10c45ece237eea38554ba16852bbb54938b6ab5e6200871a2a365c3e1a02954
MD5 766ad8ebd0c96b7b4ec33dc4f5463be6
SHA1 8b73af9b4db2076ef520b7902f4be17ed2ad2b1b
SHA512 ac3ac0a7ce9bef64eb7f7e7b019719dea8dd34787af0f678123bb8f39cf473ebdc63b0831818eaf010eb112f0a32aef47db4eb038815935cf20ed66ca0669d94
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2ZR0a:A3mnXoZjzyaT4aewsAjxTcgNaB2ZRN
TLSH
T19B25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 963KB
SHA256 07f2d8e870d55f91dc4dacbdd20fb9e5f4ea9aada34a4875bb64e5cf563655e1
MD5 59247f09732528489c294a62275df554
SHA1 a28a44d7cb7d1a21a437237436be6d82766a3818
SHA512 bbb07e5e49a8a9ab2011a18b3099e3cc01f5418159e174d755c3d0e7f0521db6056161c1b991b54ac3a4e6f6411cbfd678246aef7a55d885c833c7e50159d8a1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2ZzF:A3mnXoZjzyaT4aewsAjxTcgNaB2ZzF
TLSH
T1ED25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 963KB
SHA256 01857e17c455477dbeb7f877260d4b18b792bdbfa9b47422eba747ae934c121b
MD5 10c6c1c9cf8867cd4706d7f06ce8a754
SHA1 78624c8f26e53eb1533b3b110c24f24af7c70ca5
SHA512 14cc8f6a847accf03b912de0584233e90e349231bc62fc59e12429207d67c250108a03f2d5cd4e4864b625c3b25687abee700f4115a4539c7c2dd328f72c14aa
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2ZcC:A3mnXoZjzyaT4aewsAjxTcgNaB2ZcC
TLSH
T19B25B023FBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 963KB
SHA256 e8dcc70b1af2783d13f6dac12d51f6d0ed11b9975375dee41b97aa4ce622d700
MD5 70391f0b22c590e8a64c2dafdcf90f90
SHA1 dc965299cd749c9fc4ec4cb882cc630dda37cdfd
SHA512 67365ffc0d7dd00c9d6de64414fb350b719086561f061dd1ddd99463a327fb02477f1febf9e40de246d8768604349966a8a8b534d6fe4d1d8b8a595f5a33e149
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2Z3w:A3mnXoZjzyaT4aewsAjxTcgNaB2Z3w
TLSH
T1F825B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 963KB
SHA256 24d6300fabc2ccbeaca33025a0776e4ee5a42bf9e28f001867ca7d970e410e6f
MD5 9998b3fbe48e8a6ab5a7b1e2f44b493a
SHA1 fa089b06066e5bfb89bc6096f41e650183f332f8
SHA512 0b74bf44a8937d2c7761f0fd97da4859f5f4f983164c97313867bdd043668591efbb7ad3f246ab3e3484cc9d6a5c1879ef48f3222b1455ffe0e415beb1a77f30
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2ZmT:A3mnXoZjzyaT4aewsAjxTcgNaB2ZmT
TLSH
T14E25B023FBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 963KB
SHA256 55c682469fc4c5ddfbf23fbcc39ba7c769daa7d2949c28b9a05dda418955ef45
MD5 cc458a7b8cbdefca47ac0a6cbbe837c8
SHA1 2998ac98d0f47c96b4e30c2ecde5cdc34ff6cc71
SHA512 53b5d007bdb5527ea445164525500bed25f966657609b0eb2ae8953b44180141d54007bc7369abb03cba33d1bf15500aa02dbb7a12482785f0fc1145da3146fe
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2Zeu:A3mnXoZjzyaT4aewsAjxTcgNaB2Zeu
TLSH
T14325B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 963KB
SHA256 77560df3a63f394e913b8f797b109a4435ae426dee6afc14e60c61a2a965d26b
MD5 f543e5808aef080d27990b838caded2c
SHA1 570a6919b624abed3c2ff274a6b12cf4c677407a
SHA512 6cda40caeaae55540ee257a6deea8be06482cf968600837614cb7df2223e7bef4de22bcf59b17b4962619ea51baef4b2f82b831b8335569290040df3f320e866
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2ZYb:A3mnXoZjzyaT4aewsAjxTcgNaB2ZYb
TLSH
T1E425B023FBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 963KB
SHA256 58751a44a2a465a77150c0687a0e8366bfcfac01061ced17752951de5fe932bd
MD5 e71707ba581cc9160a2300cdd0d32024
SHA1 fd262e3da80269ccd6fbe599f6bac999ab1e799e
SHA512 0f2e58ce01bdaf0acde155ff51f925c73e41dec3fc257da7fab0acd4b091489fd89902846fc8e20ae8d176154d0032ce5ea2a7b4a3851a41709816527fa1d8af
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2ZGf:A3mnXoZjzyaT4aewsAjxTcgNaB2ZGf
TLSH
T1A125B023FBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 963KB
SHA256 78b2aac8e977e1af9ae308ac746e235061da4bea7d0e8ef0d1240156f885ce31
MD5 b45f05a683e53bd5e0cdf0e41f40ead2
SHA1 67d88cb38c617ea75a26bec72a158a6b86e4e643
SHA512 546e427848a221e6fc1fbf95bd04dfa79a223c7d00404efc8291322014b466d235ccc41db749dda8a0d321bcc5a233153d029f0c0ba3edffd8c56047b173548d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2ZDK:A3mnXoZjzyaT4aewsAjxTcgNaB2ZDK
TLSH
T16325B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 963KB
SHA256 97b212c357a939a64b2af1643dbae8e5395548b94a2121393c39f89075cc5a3a
MD5 4b9dd91fe12d436590fe0558147b8d05
SHA1 b63a64160665436ac8f88799ca99add45c70e786
SHA512 d6ddb8e9a7508c3c959b5a998894298521b347e931c8261cea6bce6f8c766659aec50bd008af4118d219df9ab11d25e0732bc3b38737e0151649ff85edef0c44
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2Zkk:A3mnXoZjzyaT4aewsAjxTcgNaB2Zkk
TLSH
T17F25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 963KB
SHA256 7cd9f7a6da96f19e9a5a46ed9221eef936f72a139ac1657d44848ce2719e6a67
MD5 53e720c0a5f54b8a28e69a709516502e
SHA1 591d70747fb00e0861e2f27e1b3ace82a7293a61
SHA512 5da8a24afd8803f61c214e96afb93c1dbd582c0d217a887d0246778d61233a937a8555a08678485a03bd8a4dd5c5e1427154e98f6e262fd19a4a924407223e76
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2Zt0:A3mnXoZjzyaT4aewsAjxTcgNaB2Zt0
TLSH
T17125B023FBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 963KB
SHA256 37d9ea93e65eaa51dfa8d068cec8f711a03c98f0025361ec49ae9d5cf014b8b4
MD5 5c0e8674470649af905f59ab8c9ea15f
SHA1 aa1c643e416f74af27c540a327d42b928184b84d
SHA512 77a6ab60e02428d153e34f42945b6067f853d6b0287d913f68b4650b2d6ee5dc4bb5fcffe5a89e8d296a86e3a66c668de10459d758e895aab9539869a93fcd7b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2Zw70:A3mnXoZjzyaT4aewsAjxTcgNaB2Zwg
TLSH
T15825B023FBB090B5D23B49705BA58712EB787D210B6056CBE36886592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 963KB
SHA256 c78949e9c9e904c1435fae4014d67fc0ffdc67fae81f3409353b6cc137d77cf8
MD5 e2c7a4a7309791d7b17c07ec78386d12
SHA1 5c550ee795e9927dc946c62b2536877be5233edd
SHA512 e3d5afd138919164e3ec699ed10ff85aaae9981a021431c78a5f6219b2f7a8bf07c2a7f42581c8b28fca1764f4e2b70746ee976842cf43209cb0edb7a9adaa7a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2ZFr:A3mnXoZjzyaT4aewsAjxTcgNaB2ZFr
TLSH
T16F25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 963KB
SHA256 4af20a6cbf4afaa8ca7d5f5addd1d576d93eb770499acfedccc6b67a521d85d7
MD5 15738f652f6a8e644bebfe3e414dc9b4
SHA1 888dddc583f13a66d00c9f951fdb8ff45dc9d41b
SHA512 708edd4b80059fa308f6ca17dc5cca8420525f5ee60da304d2bb3a83045cc2e5cd2af4eed3ecdcafe61b8cb90f808786bcc34b71781abc46532cdb4752a8be0f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2ZPn:A3mnXoZjzyaT4aewsAjxTcgNaB2ZPn
TLSH
T1A525B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 963KB
SHA256 becedb80193266f5c67925fae7b2ba079bb51d61517ea70c7e6e65d2232c5ff5
MD5 2792de29a372609bdb9e788de990e0c5
SHA1 981db423c8dd83ab88733de070f2896bb49c6a7e
SHA512 3f06bd50d2804fdd72d48ad4f91b339ecb721176d712bcb7a8898befb2d01b71cae106e780b97cdbacb5b984047f27c372e12bd6ea1b84a849937015e2600f02
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2Z7x:A3mnXoZjzyaT4aewsAjxTcgNaB2Z7x
TLSH
T1CF25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 963KB
SHA256 b6fda45382192fe0fec871108581497003d8a93fc6e1a0583a2adc42ecd7ca0e
MD5 4e08f875c87fd4b5a451457fc48f624b
SHA1 2125a33961eedfb12000dec75e9b6cd8a67a1588
SHA512 4e6f3ebd57ac1fa45fee7cdf7a2f60d4afc06dedc730e4118a278217eec6f43f5bd29e4a2037a35250e7a6dba4e7d5626b77e9cf43b71e09318672462b007617
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2ZpA:A3mnXoZjzyaT4aewsAjxTcgNaB2ZpA
TLSH
T18F25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 963KB
SHA256 d9e11cf9d65fe0562831adb7f0c23db45ccd4df824da720abc42ed0b5c311710
MD5 e4f9d439eee121dd1b7b00f74c3c0868
SHA1 c1f5e633d7b7ae10f446af350b712ea6ca1a6010
SHA512 c17df78796c2aa021e8af85c1c475587c9b72ce377d5b421faa87271335e1abbc43e0a1147a035f8dd8d5323a8512db2e02d982db49b6edd584d9f8fdce1b2c7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2Zi9Q:A3mnXoZjzyaT4aewsAjxTcgNaB2Zi9Q
TLSH
T16525B023FBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 963KB
SHA256 c9b8428eb9e1392da723eed5cdd8b3fbcbdd53f3e17eeaf0316406fecde18172
MD5 c32244c1f48a948b2b4d6c21151dae6c
SHA1 ae50f823ea0b38932ee7d14d78195996fd2b1f0a
SHA512 a50bb57cf4d2020b88f75ddf8d41f5ff039c11e4386b093c5b6482c6064bfd4753c24c54803d9da98fbd9f7447305f50fa6868312bac71c373364a6622c2e1a0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2ZH4:A3mnXoZjzyaT4aewsAjxTcgNaB2ZH4
TLSH
T10725B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 963KB
SHA256 73e58cf24516a69a1bd61d74bd6cde571bfb5d5a4b7f3cbf4fdf2a3f8a76b0db
MD5 f7a6ff82e9c9f290ea78ce9c46889b0e
SHA1 20cdc8aef5b174a6c7502cbdb100299b9d89c118
SHA512 091b61c2898d655e4b59f1878e3e88f1358ce7a694be04219f6515ab9da3c888d47ca5c6f02049381432d6519591ced676557156c1b4952c757526f51bb69989
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2Zmu:A3mnXoZjzyaT4aewsAjxTcgNaB2Zmu
TLSH
T10825B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 963KB
SHA256 5f3edb6627c1a28eb771648b153b6048b19b7def2076c6d5e940e9ec6183bb6a
MD5 91c95ddf4e8dcd32335599b0b109ee1d
SHA1 fb5f51e52171fc17cba416c32a3e865d06c7e75e
SHA512 7ba591c921788324b210ea5fb7df44eb831b33bbbffc4a77f903240926be336c379bb55103a1bc0a8835a2eb1c62fee79aa491a947895177cd393df2909c6ae0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2ZXj:A3mnXoZjzyaT4aewsAjxTcgNaB2ZXj
TLSH
T1AE25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 963KB
SHA256 3125c4f3a157b401c48d7f51d599e72b396f437474bc59bcfebb875718fd713a
MD5 69f9be9c196a256ebf2045bcefeae2a2
SHA1 95c94965745f4c810200a630df6e97129e908dd8
SHA512 a138816fa21e394f6eacdc88af0680ad7f626b8ec089955269227897a2536a10016c16de3ce4dbb78e12b5e7bda449bb1f2e9b09ed223882801309c657d2b7f4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2ZCg:A3mnXoZjzyaT4aewsAjxTcgNaB2ZCg
TLSH
T13425B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 963KB
SHA256 a957c1d0d7b77ed330e1a71d94602564361c65fc8fff5f310601a5cd6043c6de
MD5 36211c3a5a25c8974a65a0ca15ada807
SHA1 1b4a1dc22632f3fa3602d42d72304f872aed8079
SHA512 5af051bcca2b2c6ec9c182c9e5c5e81cbb211bda0e51e51fd157b4e81668a9a55c45499808088b469f80eeb2ecef1c643bf9bd7c4b2c5d91bf81223b8b4fe3a1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2Z9I:A3mnXoZjzyaT4aewsAjxTcgNaB2Z9I
TLSH
T14225B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 963KB
SHA256 07c8ad9203e168dc71599d09b3c55d5ee4c6db6ec3ed691835f62c29467387a3
MD5 3eb65bcbb2d4a5bb8b3abe2eb29e17ab
SHA1 aaf738f67af2cf3a076848df3f14f4cb790ce5f2
SHA512 4e636927137c5238d3bc5f426d0f0cd0f2cf1d0a0e83b3163b9cee05f3cbf990c6844773d1caa8abc16b7fe75458f216b2f4ef80e969ae4618a5a2c6cb977116
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2Zvo:A3mnXoZjzyaT4aewsAjxTcgNaB2Zvo
TLSH
T1EF25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 963KB
SHA256 7f013f9d10a3098a45469903cd281cebc474a7560cd22bdd18f61f6e9f724d8c
MD5 a7848fcbf80918601613d761c72fedeb
SHA1 2669d21bb5ec6a4d4284af963deadec25605fd00
SHA512 78fb60f40620692703ad936f37f60c7fbb6d98640fa163cbcdd75b64f909bd1acc0bea5140ea0ec412ef99f51f5d1cb8fff8e68ef3c869f17ebb2cc34aa893ed
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2Z0+:A3mnXoZjzyaT4aewsAjxTcgNaB2Z0+
TLSH
T1C425B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 963KB
SHA256 3ac1e1786419c1dbc4f3f224ab75e3795cbc476f0fddac991ff64ee6d1269227
MD5 68250911574553485f14f88ebd025a7d
SHA1 0fa4a1d376c369e50f9900ebb4ea8e5c45385eb4
SHA512 0f2c94bdc7c77703e4055a849f6a17425e29cb05d49d745f2640af21da7f48cd4ef0d5a5dc1ace4a47fbee95f5d5c2837499035fe40881f74e8b5923b058a551
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2Z8Q:A3mnXoZjzyaT4aewsAjxTcgNaB2Z8Q
TLSH
T18925B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 963KB
SHA256 5f67845a54173aa3be0896ab2e796ac6dce1d708da40869ec4185f7507620915
MD5 1ceb7909ed1289173f556bd63f2cb011
SHA1 0abd3b03bb3b2b9bdb855b3b7e65be00c8776197
SHA512 f54e9f24e728e44e301c229ea9599d9d3a260397c0e9471a19e747321145131bf0fc343410dc6fc6e97b9ef264b5329d0d666820544aeb7365a8666bd196558c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2ZlX:A3mnXoZjzyaT4aewsAjxTcgNaB2ZlX
TLSH
T15725B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 963KB
SHA256 e0c2d720a7f337487c86f632aa374ac3caa940701ef647f3d36d7abf83c58c51
MD5 9fa7e9343d8af1e1ecda4f4a0152cac7
SHA1 fc359e02ae4beef01a369e535a3d04c100bbc0ee
SHA512 8a4302c252efa6646192e8f7fed2570c655a213218b60cf7fa09d212e8f2b7e2ba731e8556f5e5f595965402c1598bd57862c880c7e3beb4362b85f8e70759ef
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2ZHL:A3mnXoZjzyaT4aewsAjxTcgNaB2ZHL
TLSH
T17925B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 963KB
SHA256 dcca6cc9ec8f491b5c8ccefc0c81319d2917c33ce56a61fd735b3dae05601297
MD5 858c2a88213e2c1bd261607fe5bcc5c0
SHA1 52d27b1e3373d330c5b35ed16ce64fe6e8151040
SHA512 26c374081626bf152d15cae97560cdd84c651fb6821d814f583304ea7505dd71c1235edfe59a1ed89ad1da3673e8cac5fd6a897b31b21855656ad1938e988c8c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2Z9FC:A3mnXoZjzyaT4aewsAjxTcgNaB2Z9M
TLSH
T18725B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 963KB
SHA256 1a0121cd436ddf212a19bb4750ef92426190c070309e6cc01352f8da38a136e5
MD5 c344dd2a306d6d31733befa557fedefd
SHA1 70abd6a289545575c613d1941c60bae5e70542e9
SHA512 3b89574c57bc84504de4461760ded887ffa1508972d92994bae30e665031e7e46d0a145fe4ae63372c425145054bd070ae80b184e67cb07bfff10daa76701b77
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaB2Zuh:A3mnXoZjzyaT4aewsAjxTcgNaB2Zuh
TLSH
T1E925B023EBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2028-76-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2028-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3280-107-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads