c5fac7b637dc9d786348cdb5785c8fc5529736fefb2e6d2d46346bdca7071043

Analysis

max time kernel
109s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 10:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Size 897KB
Sample260804-l6vrmscn4w
SHA256 c5fac7b637dc9d786348cdb5785c8fc5529736fefb2e6d2d46346bdca7071043
MD5 b3e5b811804a7305c47049458d0813d4
SHA1 9c091ff0044fa5b3353e8f591d87654897b6dd1c
SHA512 f4c3dd49d836fe164ad4e3eec4b75f85d8d6bac1227ce33d24c04dd2716f85588e3cbbc15084db9ed3acaed8dc27ded5c9ed16a96d393d43b45714a6f6d02734
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBp:A3mnXoZjzyaT4aewsAjl5SaRasLaBp
TLSH
T1F215B023FB7090B5D27B49705B658712EB397C210B605ACBE3A88A5D1F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4224-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c508-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4224-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3776-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c95-59.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-432.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-543.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-610.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-641.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-726.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-745.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-794.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-843.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-868.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-896.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-909.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-934.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-953.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-990.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1045.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1064.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1107.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1139.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1184.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1343.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c508-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c95-59.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-225.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-262.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-432.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-493.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-543.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-610.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-641.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-726.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-745.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-794.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-843.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-868.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-896.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-909.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-934.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-953.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-990.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1045.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1064.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1107.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1139.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1184.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1215.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1324.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1343.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1368.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1375.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1382.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1402.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3776	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4224	2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
3776	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_b3e5b811804a7305c47049458d0813d4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4224

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 897KB
SHA256 c5fac7b637dc9d786348cdb5785c8fc5529736fefb2e6d2d46346bdca7071043
MD5 b3e5b811804a7305c47049458d0813d4
SHA1 9c091ff0044fa5b3353e8f591d87654897b6dd1c
SHA512 f4c3dd49d836fe164ad4e3eec4b75f85d8d6bac1227ce33d24c04dd2716f85588e3cbbc15084db9ed3acaed8dc27ded5c9ed16a96d393d43b45714a6f6d02734
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBp:A3mnXoZjzyaT4aewsAjl5SaRasLaBp
TLSH
T1F215B023FB7090B5D27B49705B658712EB397C210B605ACBE3A88A5D1F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 0e5c4bf8fe4c481f7fe1cdaeb587d2829694daf32bf0d38c5359b4de25fe26cd
MD5 9fd1a41f15eb4028a748ca82a02b6826
SHA1 c077cccee6711229fe371224ae778b2c52579fce
SHA512 299fa06f3c1c47f9824847b3183737b7f8ccb545a959a84b71e52f6641f62315330d65bc2621377696c8f0a9d15711621349085f4b56ff8a6f0fd7f2157f5fa4
SSDEEP 24576:A3mnXoZjzyaT4aewsAjl5SaRasLaBV0Le5ji0hmxNrM:A3kMPlj0Pji0Aj
TLSH
T188658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 945KB
SHA256 a142d3eab431354a1be4297f6f63eb765bc8a16444dc4cda0f76c2381bd5857d
MD5 e18343dfc72273d073c8c95f3eb850ad
SHA1 9b8e641ffd9ccadeba4b8f12b4b94eae848321b1
SHA512 f4c95f926fc126c565fe9d6c3b014180a9b05fbb3f9851aaa4248d5fb8f5c5f47e71fc0ead93918043ce4b49438cb6f9c08837427f190670c534a844437551f9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaB0b:A3mnXoZjzyaT4aewsAjl5SaRasLaB0b
TLSH
T1EA25B023FB7090B5D27B49705B75C712AB397D210B6056CBE3A88A5D1F317C06B3AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 921KB
SHA256 d924c573946c0ae2aacd0aa6a6ea3ec4f897af1d6c93ecd66d1b2236c244a191
MD5 47e925b3471e334496680bf3379943c3
SHA1 ed69d54246c79c353e27ad63cd1e403ca6cb1c66
SHA512 5da74c0040108125937717e43c8a0a7b96c8ff262678dc5cc64da0d152d7284652487ce76e126c9bb4f036447d6d763dac5540f136e2ce56484a046794f5825c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaB26:A3mnXoZjzyaT4aewsAjl5SaRasLaB26
TLSH
T1C815B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 921KB
SHA256 d9172e391b5f1b799507385211fb80f804b419abd2ac30328dac0dc0b92a8221
MD5 66d41afbd8cf953728c55031d905d5ec
SHA1 63dee15e006bb40f24ae6bc53e0a1227f4ae67ef
SHA512 65c081f33c5a3b041e193ad816b425f60a07e7703b4b4102f524326840dc258764d1c1eefe02e96596e1a1bba8cfa3ba64f500f5bd39a6c8974b5fca58de3cfd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBmN:A3mnXoZjzyaT4aewsAjl5SaRasLaBmN
TLSH
T1C115B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 921KB
SHA256 3bcf7884c60c22901d85afea6dad4bad4c7d1404602b6edb27b37fa2e9a39b44
MD5 7fe828126f60af05b8ad9c08dd10cbe4
SHA1 fcbad5bdb7195aaefce8fc418e241bfac2ead787
SHA512 815a77c1f6fdaa8fcdb7d5eab404a8ddc8b8d033670abb01e2d2b372f3c935d2a82dcab851bf17837c8a797de884964be9d954757a4b4cc12d3d99f7853e699b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBkf:A3mnXoZjzyaT4aewsAjl5SaRasLaBkf
TLSH
T10D15B023EB7090B5D27B45705BA58712EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 921KB
SHA256 97d1fa0f75fae55c325bf3973100be715fcdb6e15d78dc5251b6c424de0b8e51
MD5 4a0d2949fb4b32bab339050523eac4e4
SHA1 283092e69cf8530b1fcc6771ef45e1f580e2cf08
SHA512 3aa0c61a32a00c966900b94c38c9f49e9949bba940c8ef3170eae8a47df85c113fbfaf0913f8954c690182a05f58263670979e357219b710c674d07a450be4ba
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBOo:A3mnXoZjzyaT4aewsAjl5SaRasLaBOo
TLSH
T1AF15B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 921KB
SHA256 ed7f32240e657c7f1df4205ad61156f65a3bfdb30ab2d4f3b2c87a0cf8e475e9
MD5 287c77bc1d7c6eac62909f79e439d08e
SHA1 b036c984632b9ba98d6c918782bb80ae5e545eb9
SHA512 d29a15bd03c0835df4d50cc9763a85dd86da04ac6fd56a3c86cd2d732a017340fd267e986788b942fad7315e60aeffe6ca1969e24c461b2bd075d52b337695fd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBiu:A3mnXoZjzyaT4aewsAjl5SaRasLaBiu
TLSH
T19015B023EB7090B5D27B49705B658713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 921KB
SHA256 e78e5e2a672ae426ffb2d99b7495408a25c9ed855b39d60e64a8086b51eb8fa7
MD5 18fa8ddf02264100e868f8ef38c845c2
SHA1 168f906daaf27df5b785dc14ac5eda138ee00a2f
SHA512 8da96a138d486289d9771f07032f36de3364aba5e2cc3ce55b98c5ee4441bb7b48203f8ce927fd5f600e6fa2b83c07b4904126bd2cae4f9372d6636e45514fa4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaB29:A3mnXoZjzyaT4aewsAjl5SaRasLaB29
TLSH
T18115B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 921KB
SHA256 48ba1e609e1cbe453ddf32bb6a5e5969c7ce5fccadec3ea4679a0f91aab3305e
MD5 78ba9ecc7f4cbb7408af8c979ffcbeb5
SHA1 97bef4c8a81958065b3257970890ba5a583c5efe
SHA512 c50b0c8f2ab2a141277c06461a98bc41a0dc4647a2c419c5aca27318fcd60a952ada2d57e6c2ee392ad14e3c9dc6792a6f2920ae36d4cb0b7d6dc25d6eadf62b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaB2c:A3mnXoZjzyaT4aewsAjl5SaRasLaB2c
TLSH
T1C715B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 921KB
SHA256 2c99a4ab7b51310e6915d138f9966f937476d3abb3b1e168863ab62ce7c6073d
MD5 3365a41157a8f0c5439f63a3ad17a261
SHA1 83a08b31aed63c05c206d2a36d1484b7e9b031f1
SHA512 e9d4d36b07d76021de8209a68b995af3b33625505a86034dc795a291e4e0710457489455050b969eb657024013e5b6440d63600c02923cbd8e7220d1b620c81f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBvp:A3mnXoZjzyaT4aewsAjl5SaRasLaBvp
TLSH
T14C15B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 921KB
SHA256 33ba50944543ac56b3ac93bdf05adcf96d9a98b891beef7b57cc3555c5124147
MD5 69285ff1e898057462d61fec059f0f70
SHA1 a765eb621249230a1bece65bcf13620da8bac253
SHA512 00777a1f12af35731b20c87cc8d7660d8811e26a42c2373a156d33ec0285a96d32dab190cd3682b6c0f5f76b2a7e37984304762743ac12d10808cccd214fa6e1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBQ0a:A3mnXoZjzyaT4aewsAjl5SaRasLaBQN
TLSH
T14215B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 921KB
SHA256 83e4356cf80403fca4a87c9c1214309e8dac8db39d9c27c694bbd860465f8bc3
MD5 83b5a0b524b0366c53446d6b1836a15a
SHA1 29f1e4eceba826bd0987bd397cbce210cecdb007
SHA512 bfa8e715bdce25795b03f9bf5bf2e28888dc55f19ecd88bb5185a7943de573e630a8ebfcbcf41c3292f4fb5c6ccf0c9259fb2728624aa37d4c645cf31cbb9c11
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBYF:A3mnXoZjzyaT4aewsAjl5SaRasLaBYF
TLSH
T17A15B023EB7090B5D27B49705B658713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 921KB
SHA256 666fe46cdf475f3b7e2b0a51a7e4b0b9d9781c41e4fffb1c952e750dd5839ad3
MD5 7e41aabbb63b9fa4cc9b2c8ec6354f64
SHA1 ee47f29b3c1e363619f918f1fe757e76ccab67ce
SHA512 e07bf765fee51f7c37d3e4d1ace175c1af51a0747ea3955dfa60373e9538d25bc19d7ed734c02857e26abf7494cd4ec43665453d2ffd03fdf1bd04e7ba309153
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBNC:A3mnXoZjzyaT4aewsAjl5SaRasLaBNC
TLSH
T13315B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 921KB
SHA256 d4baf352111a77084ba5f5d1bf04ee60329dc350ce069ef74afa2f1615681e3c
MD5 180c2f2f1ca5e99a7269a5244c510448
SHA1 88d7fdc1b280791302102c3fc3c61e5c207b00f5
SHA512 c843a181402b0ca45b92b247a473e249be161fb15133d10075f61770619f351d3cbbdf6375082a0e984342ea25039c0164cf591a534804e72a5d4bfafc7bf008
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaB2w:A3mnXoZjzyaT4aewsAjl5SaRasLaB2w
TLSH
T14415B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 921KB
SHA256 310d7606915b45fff2752b86b57772be43d1c6e3ca0575a36cf441b44cc7a8ce
MD5 e4ade0d673a37e3ddef4dc8e975d1fed
SHA1 057d34cbb2581b2ee174e59b2c46e6a8eb78fb6a
SHA512 7b5143ff4c9da3d41daf9c75998f32c93e1b85813dc450ab64575d42c518bc85ab06fe4b29ffb2efdd78150038c1876f794786616879886b1713e4da24eacef6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBlT:A3mnXoZjzyaT4aewsAjl5SaRasLaBlT
TLSH
T18815B023FB7090B5D27B45705BA58712EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 921KB
SHA256 505828cefebdac5201069c54dfdf916e5de40d6c5046966713c2a8d0f2b34f1e
MD5 142b9950fa2c081005978c8a14696c5e
SHA1 5a162e5da0c1e6f191c23e77b4519b48bee386b7
SHA512 8ff879c6ecbccc4e2fa6e9d9eeb2846472540458ee43f9516098564d33a3cde8bef094e9da97e11c61554bbee3d30d437c75c10058cc70b0487a79b02d024cd3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaB7u:A3mnXoZjzyaT4aewsAjl5SaRasLaB7u
TLSH
T15D15B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 921KB
SHA256 4fb8a9e5555970cc39108397aba571f33c78676c1690b2911a52c7a91c3d8242
MD5 acb2dff285bfe0d5796e444af61125aa
SHA1 005f0e4c098b11fb45f62c3fefbc25b535fb63b8
SHA512 f7e4349b2b090f3c697b991db61a34569ad44832db81a3e45ecaf747707d61a76692763c3a94cb2ae4be01435a385b073fde319b9e0c119335f5bce839188723
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBfb:A3mnXoZjzyaT4aewsAjl5SaRasLaBfb
TLSH
T17A15B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 921KB
SHA256 8af98a86e8b6f9b37ab0aaeb673b1260e1e8efe955158829ed345610b03761d4
MD5 c7d1548cdb83e3711ef2178bd14190a4
SHA1 abb36f3bc41d92fc3540060885e35054760cb4d9
SHA512 ee46578e26c8023ae6600a625c3a2b831e025c5053caf16f5167f62637f14b7cfd75553373b4185a9c91f574833611206215fc31f1b74f8840932f7ade39269c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBbf:A3mnXoZjzyaT4aewsAjl5SaRasLaBbf
TLSH
T19315B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 921KB
SHA256 d7eeacd0f27d88f320543351f614689081f8447b95d2be70c2b48165b475bfd0
MD5 7ac6d5f0252ec0bf9663505fb38a85ff
SHA1 8cfbe67c73c6a2fd3f186a1c6940c72cdb198607
SHA512 10ba2630bf653fa2551f648e806491d5d7360ae4861216c9f4db7d437b924ee42238878e0cc9df01297d76ebbc63c3d0717adaa055adff32f72abfa3664a3b40
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaB0K:A3mnXoZjzyaT4aewsAjl5SaRasLaB0K
TLSH
T10915B023EB7090B5D27B45705BA58713EB787C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 921KB
SHA256 b426cad2817924ecbf5ca90b6506d0d946e1c86e0b24eea995452b5f4b8b4d3a
MD5 3f2d22d7602f6db19d3ec52f3d47a3d6
SHA1 2c883e78df5054ee08571b71a65169e10d59a942
SHA512 f7a6432a7afe57a87a7c0d0e238afdc2858c7ffaa40ccacb52fa48c89d836f4904122e567eb45ff5822b2311ea0266f9ba22f770ef44bce39f99130ae1d37d9f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBpk:A3mnXoZjzyaT4aewsAjl5SaRasLaBpk
TLSH
T1AE15B023EB7090B5D27B49705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 921KB
SHA256 c01208f2893daf05c712bdc38d06d87ce291811b7f2a33325cb6f96687e1aacb
MD5 a7674cd65028a30bc9283d5b0ccd3ddb
SHA1 1f16f7863449fa24d4687f934b71745ac6593a59
SHA512 868a0ee9596e58f0c3ff2212d78b4f11c3a58247d139f8ede1d1dc6836738b729fc8307825ec83397428864270f3f8d14154f895698497ff0c058c7d1679b110
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBG0:A3mnXoZjzyaT4aewsAjl5SaRasLaBG0
TLSH
T15B15B023FB7090B5D27B49705B658712EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 921KB
SHA256 51e85099621e39a1ce594996d916303cd229523789003c378686570ae4d072f4
MD5 281d3b631e97333afe0c565de4edcc79
SHA1 9dbc38cd61bb0ba99718e03c8835e01cae611c41
SHA512 376a3e40cf7bfa458f10a2de015d5b83ea69a03fd63f90d30af49b50a80948103f3932f543b94e6ea8018beb37a12b82742564e35d3f992470373276f2e638ae
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBV70:A3mnXoZjzyaT4aewsAjl5SaRasLaBVg
TLSH
T1B015B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 921KB
SHA256 fc36fd030e1843aa14199fc61f48f9bcd5aefc41ad9be6f572ed6457e0c18a31
MD5 17c0d3b546b0d8ecc58f34698bd5c5ce
SHA1 315ae5e60a7f654c35f60801d959f546693fd799
SHA512 3c0530eb7db20e01f0a8ed45670263062516dd5b404198cc39d1b594853ec5d19e5017bb384c0a46213ed9af1fd149fb2733a51e96f57debc933af3054d20aff
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBkr:A3mnXoZjzyaT4aewsAjl5SaRasLaBkr
TLSH
T1CE15B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 921KB
SHA256 3f5e1e8f4870b983084080bd481e0f03e3380e1df61cc50942a201580995bb8e
MD5 3569f40044a4d6075c053519638169d1
SHA1 b9f84b8c11a585e67e28933d4eae9b307f4e3798
SHA512 f2bff31e39de0ebfdfb4af5a61ea136de967fcbb92c8987282845b61a0cf5564ceefc9943f7086fb775a6f1bf18b2efa75b7d40d6bf481333206506c7feb4e2a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaB6n:A3mnXoZjzyaT4aewsAjl5SaRasLaB6n
TLSH
T1B315B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 921KB
SHA256 85b0c5e81645f12bedf3eeb9d7b01d21a6f0d1bb558d8e41cd10bdcf0cce08f2
MD5 495182e79b9418b2955bdec847ed3fb1
SHA1 fe8e612d185b594fe384e2cc13337471a8d42eb6
SHA512 6e0553f165c221f24a30c19d8730bb4860dc838e1886db9642734cb2c7eb13154aa5c2df326c5b26a8f1bc0ef8adc437b4cd980b91b658e7d5c87f4bd8fc519f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBQx:A3mnXoZjzyaT4aewsAjl5SaRasLaBQx
TLSH
T1F715B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 921KB
SHA256 b260f2ad0c505256c259ce11100ea4dd06a5b4c7886802bfec30d015df987c9c
MD5 ad4fbeba95f488d96ae919d9490e2de1
SHA1 3b809d10b4e5ca33d922ff85eaa9c613a526d657
SHA512 5c1e5a566293ee35d15d80b6626fe4a62a871ff2a45c2e28172792f5f6a0d2a8371253de1c5d38b3ce9dfd75e415b7ae022f0714f11da25334bfd26c0d201030
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBSA:A3mnXoZjzyaT4aewsAjl5SaRasLaBSA
TLSH
T18315B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 921KB
SHA256 c6e40e8a08828d0fd0f4076149bd444eb4f449af2209de62174b90ae0db59f35
MD5 ed5d20409aa830df5779d47696903e2e
SHA1 8b7665fc7c2b17c23d5fa6f245b72a5774cd9cf6
SHA512 6a68f098dfd8ba81e171506cdfa2b0cf6140ac7a8c009d3c27c0dbdd814bbf67302cda9a3d962d571e3ace2e5bd9c8a02f0d1bc1482af602099379a99b47efd8
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBr9Q:A3mnXoZjzyaT4aewsAjl5SaRasLaBr9Q
TLSH
T1E015B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 921KB
SHA256 32a17f4d11848e1e84ea4f164fa5359d17a0e64c9fce9db7e02e06d2cc8cc28e
MD5 798dbf47b52d7cffa7bd1e40519f1775
SHA1 5c1bac47be3b8d4a73bac45d87cba9076dc2d124
SHA512 196b7131031a5e3e92049b932c1bcd96f818235e6b04d1a0e8e4e7a9c618acbc6275cc77c129633bb9b6da44f0c2cf7793fe87ea41464491c814abe3d7b98813
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBa4:A3mnXoZjzyaT4aewsAjl5SaRasLaBa4
TLSH
T14A15B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 921KB
SHA256 b422612fd4f1bbe23415fc2bba5e011016af7e1b27bd963739123e4e75b97a15
MD5 04b2acc1b2ac9731eca997bfa5dd34cd
SHA1 9297b5f3064c2b80680452ee14c9da0076fe7451
SHA512 e67db88d5243cc0d4cef249a6fef0a271871787dd9c7d723b5ec989dd9f312f809fc93d8d4dbaf5acd0f17d9cee0a3e2fcfd8a6efc3fac14ab02ed3d5337d307
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBBu:A3mnXoZjzyaT4aewsAjl5SaRasLaBBu
TLSH
T1B315B023EB7090B5D27B49705B658713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 921KB
SHA256 fdeefe410fcf9bb231fe40bb300b22063de0ef6ae443996c5964292eacc08da7
MD5 2cb4166655dd88dada2e9411cfd39be0
SHA1 bfb32a31be91dcb96ae325588251734cd9a6b1cb
SHA512 8e8acdced9fde5628a33037b0a0e7fa3f07958640af3d2f24b3251a9b3f71c8361a3825dfea64e20b52f707c150339cb2fa4c8f01594ca0031087f0c4da01eee
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaB0j:A3mnXoZjzyaT4aewsAjl5SaRasLaB0j
TLSH
T18815B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 921KB
SHA256 6562e717e262da913a2dc7ef2578cd9e752be317b2d7a4a174d25178e0ba6d51
MD5 bd2eab858378e64ba9a679ca03e0f479
SHA1 c7b5d7d6fe098a5977cee99254a2e5c19285b5b8
SHA512 ff2fbc65c630ede5d3465bbf53a19c7f79133a0098e6a8dfb5564b9edb1f2be3bedaab224c78c7e1f7d744ab36fbc70b561f8402a2ff924ad117717271b2464e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaB1g:A3mnXoZjzyaT4aewsAjl5SaRasLaB1g
TLSH
T16715B023EB7090B5D27B49705B658713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 921KB
SHA256 4a665ecff82cd44f69b1cb60cc89ebf5b3b161507d87aa8750aaa72966354ea2
MD5 cb7abb82a8866e37e54d003794ad8e33
SHA1 81372250571bf379fe045b826f3668fa56feeb46
SHA512 462afdd737dfc5f97f9e4abbec8b74766b16765e61ded45ec8b46b140ba80141f7568930c63d1b4258d770d64187c50f2c29a0b78fcdb76703f1adc6b91e3aab
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaB0I:A3mnXoZjzyaT4aewsAjl5SaRasLaB0I
TLSH
T1C415B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 921KB
SHA256 1e5580f0d4ca0b25c1e57f82a051f00e08ba79bb791760495aefbfada4168518
MD5 03e0a70ffc85e732c94f1f7638b7408b
SHA1 ecd2aa9d5f48a5c4e806cc1e238b4940aaea2072
SHA512 2ec26ff50850b1a77000193b52cb54665a6f541226adbec17e8581a9fa8a922c6ee2986aa5a244ea57c2338985fd752a152a3b26ccbbb0f7470b9bb85a8e0399
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBmo:A3mnXoZjzyaT4aewsAjl5SaRasLaBmo
TLSH
T1AC15B023EB7090B5D27B49705B658713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 921KB
SHA256 562f9aad78e8a9993248be050c59839c20bd3ae262d5c38f6f41701e301eb02f
MD5 5837c8882092f8ab85378c3afb739d06
SHA1 ab9e077e5d7aaaff2510cf7183f2c15594838e1c
SHA512 02c6395c539a0f71eff80b406d114463aac3000a8587c11989ae9cbcaba1b37daa530221e4e52b30d2a171a0bf707d13238d003c43a86159a5f6e48c5d6645c2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBN+:A3mnXoZjzyaT4aewsAjl5SaRasLaBN+
TLSH
T11115B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 921KB
SHA256 1134b310d398b543fa7439cb7aa6f128149da9fc024549e068af0fe16489ddd8
MD5 ff1916de973d7bdffddae38a48c474a3
SHA1 677d03e7be4c0d8769e612e69a84eb748dc12fce
SHA512 7e0dab3d6110d8d2cda147c8aa4b9e504c57ebbcf0998c9d0faed0f253ae9b68559291b201fc7286390b0929fc7a73ef80cb08ec0a874001aa5507368923bd4a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaB7Q:A3mnXoZjzyaT4aewsAjl5SaRasLaB7Q
TLSH
T10615B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 921KB
SHA256 a6ba09e72e4bd0af75dc2e4275d198eb6a4a163a1fd65f39cfbe4232d3e07d8d
MD5 0df8e42277edc536b19cd397f2a0508e
SHA1 e3cae28c65921c6ba80d4f80dd4658a6655de38c
SHA512 2e939148d44d4ec9bb8cc7dc338cf7e8ab31e41da86bfdcc4eddd06fd3e043c9c7d0dc5145ad893e79052c79cbf2a37315048752b1bfd39ce3f3ae3b2393d8d7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBwX:A3mnXoZjzyaT4aewsAjl5SaRasLaBwX
TLSH
T19E15B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 921KB
SHA256 f81ad8a7f13d495a92aa5387a6b47cc963cb325de1084540bfb875e48f411b6e
MD5 c17acc7b897709579731fadeebb7f94a
SHA1 216d6e897824eca29e92f9a199a1b75726ca3c35
SHA512 381f4921277e74c78b4c8d48e06f827a821dd7fbb6da68849fcd1a5c65e8487b624eddd06d8c0c54a53054f6aeaf4804c9887d4f30b628e8532537dd7fa97b25
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBGL:A3mnXoZjzyaT4aewsAjl5SaRasLaBGL
TLSH
T1AA15B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 921KB
SHA256 fdf00c02b963e8ca3cbe19a2d0e9da5e4e6a69f75a6019b30dba543471fc4cd6
MD5 219d9912bdb32b659a371171aa6a8dfe
SHA1 df60bb2138afd734615cf66b936fc18f10144a1e
SHA512 3be7d352909d640be3fcfbf8d6c4106e30e3e2e89f83b46c4e64ff0dce0d50c33976a42d8e9683751d81894b1707fcedf1f0ff2e6652df6711a45a95f82f2316
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBaFC:A3mnXoZjzyaT4aewsAjl5SaRasLaBaM
TLSH
T1B915B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 921KB
SHA256 d54973e47d0c8131d0d93ccbae6c755808ed13557adcc072fec463b485d8bbed
MD5 b7253afdeb9fda0dedbe9fe6ddf1f8fb
SHA1 0f8ba33f85c2cdd2de995e52e16fefb185b000bc
SHA512 f619eb4a243f498fa30b2d0fe3a7a45939cabcc4fb352b1f32c179afa9d3ccab5af22ce336113de80066b7d708a76a2ade240d93feafcd7a541ad143f56fdc71
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRasLaBLh:A3mnXoZjzyaT4aewsAjl5SaRasLaBLh
TLSH
T14315B023EB7090B5D27B45705BA58713EB397C210B6056CBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3776-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4224-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4224-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads