Analysis
- max time kernel
106s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 00:50
Behavioral task
behavioral1
Sample
2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
- Size 956KB
- Sample260803-a645javglc
- SHA256 72abb4d4ddc13b234a4e5a02238d4012b4bfb07e12ad186f2cb7334fb53bec85
- MD5 13d407d91a0a9dc70a59e29fb24a2d0f
- SHA1 1201ff2640ea3a2d57eb41d3f64ccb03296e900b
- SHA512 4b9066f60f62a6c6d05cf19d27ea00bcec78529321d52d8ea03039a18bb7f68acd4b8f29f151ed9fa2d9452f13ed930ae0b29f2fa0c6d8466f58b5a5ec95cdfb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTf748BCEvAwSfxL/2Dc3jDLLmt0LDQewsAjRE:A3mnXoZjzyaTj748BCE4aewsAju
- TLSH T12D25BF13FBB490B5D27B49705B75C713A639BC210B205ACBE3A89A591F317C06F3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral2/memory/1800-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c48a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d6-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1800-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5516-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b300-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-388.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-387.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b8a-704.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00370000000198f8-706.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a0ec-1037.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001ac01-1288.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c48a-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d6-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b300-41.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-388.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-387.dat aspack_v212_v242 behavioral2/files/0x0003000000019b8a-704.dat aspack_v212_v242 behavioral2/files/0x00370000000198f8-706.dat aspack_v212_v242 behavioral2/files/0x000300000001a0ec-1037.dat aspack_v212_v242 behavioral2/files/0x000700000001ac01-1288.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5516 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1800 2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe 5516 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_13d407d91a0a9dc70a59e29fb24a2d0f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1800
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5516
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 956KB
- SHA256 72abb4d4ddc13b234a4e5a02238d4012b4bfb07e12ad186f2cb7334fb53bec85
- MD5 13d407d91a0a9dc70a59e29fb24a2d0f
- SHA1 1201ff2640ea3a2d57eb41d3f64ccb03296e900b
- SHA512 4b9066f60f62a6c6d05cf19d27ea00bcec78529321d52d8ea03039a18bb7f68acd4b8f29f151ed9fa2d9452f13ed930ae0b29f2fa0c6d8466f58b5a5ec95cdfb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTf748BCEvAwSfxL/2Dc3jDLLmt0LDQewsAjRE:A3mnXoZjzyaTj748BCE4aewsAju
- TLSH T12D25BF13FBB490B5D27B49705B75C713A639BC210B205ACBE3A89A591F317C06F3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 827f9c2e72f163ab29c7086e1401a3e768795083d76c2e952d696a842be2f1c3
- MD5 c07311c2a70480fe18b36c0f1c6c2c7a
- SHA1 c26837e1ebda8f2a1b59a79a470dab14515bded0
- SHA512 8600527b9ecc5cb24195c47641efadbe41291107525dd349a3359140e137277c6dfdc5e4002e4663b880e2ad81c189dc3cae59a321512da76ee2a064e2e4bf87
- SSDEEP 24576:A3mnXoZjzyaTj748BCE4aewsAje0Le5ji0hmxNrM:A3kM84ljePji0Aj
- TLSH T18F658E22F6B48275D077C575CAE2975AEA3134510B308ACB9394C76D2F237D19B3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 970KB
- SHA256 54630b9505da705993feeab83dc5caeee5c3454c75faae64c77ca28df6bbb6bf
- MD5 0a69926f652a9c80302b7e633b4e730a
- SHA1 59676bb8a713c42fbfb6b27af14e2dcd2f3f2160
- SHA512 f07cc22895213afb5050a6e002de3bed25a0a7fc22d3f5fb03b24ba11be6aeee564b58c16c76bc6b5114da8c849b56b8056cd0937394c75265a9587ef4816acc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTf748BCEvAwSfxL/2Dc3jDLLmt0LDQewsAjR2a:A3mnXoZjzyaTj748BCE4aewsAjYa
- TLSH T13225BF13FBB490B5D27B49705B758713A739BC210B205ACBE3A89A591F317C06F3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 979KB
- SHA256 cec5a2541a707b18c631d85804ae99d8cf381f10f250e99ade2dbd7214fb431e
- MD5 cbeb55733ece34f241ad866d1f7b14fc
- SHA1 3bb620f2665c1dfc1b3718ba7bd042f3963fd879
- SHA512 64caa838b09da589abfdedd8e001e603e3aca7a76b10a5753f77539c2e590c8013d3b028d540b893d152cf232f2110904840faa9bb170d36efbf253f461fda20
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTf748BCEvAwSfxL/2Dc3jDLLmt0LDQewsAjR49Q:A3mnXoZjzyaTj748BCE4aewsAji9Q
- TLSH T15B25B013FBB490B5D27B49705BB58713E639BD210B205ACBE3A886591F317C06F3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe$
- Size 979KB
- SHA256 64f43ad76b0ff9760c01604959e8fe65874cb309e8309d224c98e3b4668bd528
- MD5 544d9b5398492895d8ceb53a0026dbb5
- SHA1 4f80c0dec690c484956115f860179469c88f6a4a
- SHA512 639ab602447c0df2acb61a26dea57b7c88928cdee84ae9ebe496780f149e5511ab70312603089c2a0f1d9138f6e4050068230ca398edac73c4d907ea153b28b3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTf748BCEvAwSfxL/2Dc3jDLLmt0LDQewsAjRnA:A3mnXoZjzyaTj748BCE4aewsAjpA
- TLSH T1C825A013FBB490B5D27B49705BB58713E639BD210B205ACBE3A886591F317C06F3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\servertool.exe
- Size 979KB
- SHA256 5ed890bf4b82535191d40d42ad127c911de64502a0aa42d9701a47c92c0754f0
- MD5 2276134da8152746ccc4e04f8df2fd52
- SHA1 8d256fe0b8adc1142a3d960b32fdb969749d76b5
- SHA512 b14a65139bc18506ca5c76c92145de92be53c0b95c04a2e9198f0c1a2e33c28cc765fa141485e8fde0334743017e1186f5dd61c20579cd7ec9f5e83580977fc1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTf748BCEvAwSfxL/2Dc3jDLLmt0LDQewsAjR3I:A3mnXoZjzyaTj748BCE4aewsAjRI
- TLSH T14D25B013FBB490B5D27B49705BB58713E639BD210B205ACBE3A886591F317C06F3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\servertool.exe$
- Size 979KB
- SHA256 27cf25940a8072af7504e274e897c334e28044618f326081955337cb241c9210
- MD5 027061881e3385b070c0f03276ba8a6d
- SHA1 4500911beda2b8f8c856d491d289255c514f5f28
- SHA512 32d9d25ee7e1e6e9ad54c96d21197afe59b87560c22cf8f743717da76cce81e5192d068a634cf60b9b6c49794238edb2aa0b18117bf3898fef7a8f080b56bc38
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTf748BCEvAwSfxL/2Dc3jDLLmt0LDQewsAjRfC:A3mnXoZjzyaTj748BCE4aewsAjFC
- TLSH T1E725B013FBB490B5D27B49705BB58713E639BD210B205ACBE3A886591F317C06F3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
- Size 1.0MB
- SHA256 7898a6673597357f825a6f85a8fbaf85f177e104bcffe1550ecd723edca87204
- MD5 e5634add02df4eaaf2ddbb140cfc08fc
- SHA1 d1e32f90807b24726ab2c40545824e22693e5f95
- SHA512 11053fa2e4396d787defd349315fb23f72f99ebfe643627c3e6fc9d3610d03e6e5e7c78372aa81d19e53ede3ae61ed3b39ad8eb7cb9480bf0edd4978f648b0f0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTf748BCEvAwSfxL/2Dc3jDLLmt0LDQewsAjReF:A3mnXoZjzyaTj748BCE4aewsAj8F
- TLSH T1C235AF12EBF490B5C7BB05709E65C712B638BD510B205AEF93A8BB691E313C07B36B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1000KB
- SHA256 4467da98d48012ab789e4357316ff0855f48d943940fd253fb027da800bb51e1
- MD5 fbe8b601686374f9da5361a7b86e3e35
- SHA1 b6f081101e17cbe4500075e8fa79d7e9d6c18fab
- SHA512 8bfd4d695ffd07f6ffe008032c2a622f5c551fcdf756e0473d1868e787b5b357475df09f011535fe6d232a6d70074ffb5c3257b6b9b73c39889002ff879aa3f1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTf748BCEvAwSfxL/2Dc3jDLLmt0LDQewsAjRFwZi:A3mnXoZjzyaTj748BCE4aewsAjPwE
- TLSH T1D725BF13EBB490B5D27B49705B75C713EA38BD210B205ACF93A896591F327C06F3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH