fd5777327e933df6abeb69afe92f9e4e81a61b8693bacaa5066409268da1b5af

Analysis

max time kernel
94s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Size 851KB
Sample260805-1pz3csswf1
SHA256 fd5777327e933df6abeb69afe92f9e4e81a61b8693bacaa5066409268da1b5af
MD5 026976a626e5c7dce8238c93803f7be4
SHA1 41614bd4af21ea0260776472a98a37840a20d6ee
SHA512 bd9b596720805c6fc9d73167d2f04f5be9cc7be9b1a9dc81eb2130aea11b1acf41312a79a4abeb79cd85f0f75a0379dd0ae8f7ec04ea982173607e6222ff60fb
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERa:A3mnXoZjzyalJu4aewsAjmERa
TLSH
T11305AF23FBB090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4244-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c557-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4244-148-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3212-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-428.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-508.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-716.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c557-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-57.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-428.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-489.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-508.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-599.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-716.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-785.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-898.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-950.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1006.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1043.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1062.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1129.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1148.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1173.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1180.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1217.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1320.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1340.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1366.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1373.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1380.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3212	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4244	2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
3212	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_026976a626e5c7dce8238c93803f7be4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4244

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 851KB
SHA256 fd5777327e933df6abeb69afe92f9e4e81a61b8693bacaa5066409268da1b5af
MD5 026976a626e5c7dce8238c93803f7be4
SHA1 41614bd4af21ea0260776472a98a37840a20d6ee
SHA512 bd9b596720805c6fc9d73167d2f04f5be9cc7be9b1a9dc81eb2130aea11b1acf41312a79a4abeb79cd85f0f75a0379dd0ae8f7ec04ea982173607e6222ff60fb
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERa:A3mnXoZjzyalJu4aewsAjmERa
TLSH
T11305AF23FBB090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 ff111ac2f2492ac789811dc7711769680b161ca48d7af3ec28ee5ab94fe065af
MD5 13ba2de4f5253506c1384cc81291e1a7
SHA1 5cc1e227a2d95699c7c443a192e0557f898ddbb2
SHA512 a1f0e3984ed5b2d58137c9fbf757f2aa56ded20a8fb2663d58ec1bc5984b840e8cbd3940374af458a16d4cb4e27681d579460ad22ac7db63581e0eb6a84727e0
SSDEEP 24576:A3mnXoZjzyalJu4aewsAjmERaP0Le5ji0hmxNrM:A3kM+ljyPji0Aj
TLSH
T156658D22FA748275D077C4B5CAE2975AEA7138510B308ACB9394C76C2F277D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 866KB
SHA256 2b4791d8c910c331769c6260995b2ba885d1e9b7d3a58fce20cf0a059d9c88e1
MD5 ef079816d53eda36d09c97c1528693f9
SHA1 b5da92838371cad37bf3bddf6c79695204d7f485
SHA512 db0fe5d65248674143faffbd418030a9143f89ca15f2760a97ed433894fece3cc854c451103095baa4ab72545ebbd9d4931483957ad933bc496525b83fcb5add
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERaRa:A3mnXoZjzyalJu4aewsAjmERaRa
TLSH
T11915AF23FBB090B5D27B49705B65C712E7397C210B605ACBE3A88A5D1F317D06B3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 875KB
SHA256 a75868606d3b3c0ec656eb1b3eabb27877029678155e329945e0c45ded8d254b
MD5 f4a3618376a0c9443d024de22472d30e
SHA1 1ef8be3bdc1ff56cb4074a62ccbf201439ba5c86
SHA512 79425485038933d00727df83caf05a111e39fb51438b68825178f337c99333f87aafcdd988616c7c943293edf4d33dc22005f76cd5ac72a7f6cabde13dd3f906
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERao6:A3mnXoZjzyalJu4aewsAjmERao6
TLSH
T12C15BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 875KB
SHA256 407825a7da105ba52b17991e834e1a54726c03a75a598ae9874c5cb61cac8dd5
MD5 b4cc45e5548afccc0e6f5717ad97a7e9
SHA1 801667bf4f310bc268d9427cd8ddfdf28e0f8a34
SHA512 69ec744b0dc047254862f7387ba3d3f154bca03db1f8d1a8f852ad26942a1ea5aa8b0473ac7ae45928fb0d7edce18e4146f1e84b1e1d6c626e4a33a323b40c09
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERasN:A3mnXoZjzyalJu4aewsAjmERasN
TLSH
T1AA15BF23FB7090B5D27B49705B65C712E7397C210B605ACBE3A88A591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 875KB
SHA256 3f3267c8c918258c43ab0e1c445042ea2205a32134059ec3b9e09d23a764cc2c
MD5 0d389ca391faeb9484fd3fcb8433345d
SHA1 f698845a2cacb87d5180d58f507bfe66ff81f373
SHA512 6a44a0c800e6dd68497fce382484f6ef76c85b401814673f02cba16a9465d4103dceccda7472d14c0617b5cff9e5618b38410ea376ef8d321ece97b43db1d34f
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERaif:A3mnXoZjzyalJu4aewsAjmERaif
TLSH
T17B15BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 875KB
SHA256 31d06dc6a5ecf8342f6356de99ee3ab1e73e909059b0b00fad446403763eb03d
MD5 6efa2654d70311ad7f20fb9e95c50ebf
SHA1 857b4a40739b953b29067ba0709be5bf66d388da
SHA512 cdd970fe06edd725c5ae90bf127962f07d252b856f6fda6122eeefd15ecfb89d437a0c370a0eeea05d8f00635083db49c351a0c945befb8cc68a9bbe50718f8b
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERa8o:A3mnXoZjzyalJu4aewsAjmERa8o
TLSH
T1F415BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 875KB
SHA256 0170eb475e576143a7636109cf97b7ac2c6b41db03b84d29345767153e710cc0
MD5 d69399383fa8c7d4ae32da6393e276ed
SHA1 d02e0bd81f266472b1c8a5b9d76b0c5d6f86c847
SHA512 66bc4cbfde2833707d325f0dbd28cf540f3cbbae7154393a97dcbb24614fd6817988aefdae15c8e061725f15549504263cb2e0e81d49b8947f2d53c055594e0e
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERacu:A3mnXoZjzyalJu4aewsAjmERacu
TLSH
T14C15BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 875KB
SHA256 38c1933b0fa24a87d0e06c36c069ba1cba691118e08e8a4e9353ee194ebcd6ed
MD5 37d9ee601ceb3345432f58f4b05e624d
SHA1 bdae0e54305030c476170f6b9de144220416d4ea
SHA512 6693565c35b21832d165435734e0b49c7377c3458de3a01ce4462e62ab10ab39b3b707e26f3734a962748a0d449f638c670a15338b83b93ff8fe799c35d81278
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERag9:A3mnXoZjzyalJu4aewsAjmERag9
TLSH
T16515BF23FBB090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 875KB
SHA256 6e8372e9401b86f8e167faa89efed9a307f85e3cae9be97fd793a1034a2347c3
MD5 b863e26f644160cc67f1d805bcc8ae61
SHA1 9be1b71e3812db4aa07210f5a333247a5f79aeb0
SHA512 4749dcd28ae4d3c155347bb92a2b5a8ecfca381d50dc96ae70260b3733466c1ef55a64abed6afea81c2867347eea076e7535352bba35dace6393469680405d5b
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERaoc:A3mnXoZjzyalJu4aewsAjmERaoc
TLSH
T1B015BF23FB7090B5D27B49705B65C712E7397C210B605ACBE3A88A591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 875KB
SHA256 c3979e2825c5dabd84a293756f8f15581120c42fd265fb3ec54f0f83286c0762
MD5 1913455db7ac72ee41628fb11e33933e
SHA1 21342fda1c8fc695c3b2113a55aad8f2a207f2d6
SHA512 c4691ae44e777bc0ef2de69762ce991b81575e01af732a9c555cbe9e10d7ac9aec7e5c2b97bd1cc6c6ecc39638a2346ae76a24127e141fa217e656f657770e7e
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERaBp:A3mnXoZjzyalJu4aewsAjmERaBp
TLSH
T14215BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 875KB
SHA256 0d5daec36c9c83233413c892bae0530591c8785a5ce9272bf258f23149c8fb97
MD5 9ce89431d3aca4808217a0950b507036
SHA1 1288f8fec113877bfee26c095463d72ef761817d
SHA512 2d29c69f5d52416ff407106fdd5e2fcf01c7b35d58e7a4934be525d47f5f7b3a715e3b25ea3f25c14d934692b9920a699b58b459a96b93beab47c37e8032bc50
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERaW0a:A3mnXoZjzyalJu4aewsAjmERaWN
TLSH
T1F615BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 875KB
SHA256 500c8a85d61279fa3e213f159aed17c8f60608c22b7ca06f8c7bec74efec28de
MD5 1013c8b8b519c9aa566d8a02e934f257
SHA1 f7627735d896c2ea4a96b8f466251583e420c961
SHA512 ec55ea243ceb8cb75aac124b2e8c961c3fa6ea930c268926beb6832caf07f78b12e8c26be4b164d866f7db0f873f967258a03ac70edb9eebea1e1d4b32d9cae9
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERaaF:A3mnXoZjzyalJu4aewsAjmERaaF
TLSH
T1B615BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 875KB
SHA256 f6b17914dbe61f77166901dabc64817c6da598c28175dbc113746c9a39080026
MD5 4479a1519075d9deb2e7da3b60676f6e
SHA1 064e62a1df00936b7bbecf097972a53af7404c6b
SHA512 ee114db1387b10c4e7b18e05707c5264f4f69d3e241fc42b50e0195329b6e5e07353651255aeeebb0859bc1eb527af6c67a19d1a28ea3930aca4bad1a2d56f28
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERavC:A3mnXoZjzyalJu4aewsAjmERavC
TLSH
T17D15BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 875KB
SHA256 42a28cee8f50ed5c0fb5f1279b2f67227e468ac7ca35221715d634e496bb750f
MD5 bd51f4d88f030bcd29bff1903fd08103
SHA1 31c34d51020f171930030ac38344e25b8298ca04
SHA512 32d2b8c889f79ca7f154388fed9cecbee550a65662d58d099a4723cc6076df66d21c09a37bfa346545ee5631d578e8da5c1669bb26e06537e75a7705d451c2ed
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERaQw:A3mnXoZjzyalJu4aewsAjmERaQw
TLSH
T18B15BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 875KB
SHA256 8c4756c5dbf24e92916472977737ac97f56096ab3f6bd1c5e35261bd83c6d48b
MD5 de70d39a30ef79c120fb690a0083c656
SHA1 8be170b2ae6a466e6f3dad2b2f06573322d4c528
SHA512 1c54c6ad44a28bac8bc6c21c980b2ba2e251329c71eb3ff69e20e46c346e6b4ac6d9679cfbaaf7f73408c6bd11e1a121d51f95c831b68595b7ce2a4601dcccb6
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERavT:A3mnXoZjzyalJu4aewsAjmERavT
TLSH
T11715BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 875KB
SHA256 96a31b6f3223c99472469cbf5a6ec1bba11281de164d207d7d31a22d10ca8111
MD5 05f5c2207730603d1ba333808cc3bb39
SHA1 f1810ad32c5a05019da46c8a90bcba9eed711a16
SHA512 247acafe9118dbecb72720a6d3a8c23d316ac437fe899489937ad64923814af20e2ef924c875731e7c9d421edddb4454dbc89fa10e925ce4805053e227ad9d20
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERapu:A3mnXoZjzyalJu4aewsAjmERapu
TLSH
T1C315BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 875KB
SHA256 1d94aa92a3a6265841a4a9753ad828425549ca56eef064381da082a56068be82
MD5 9fce41d76f314fa341efb3c5ce923316
SHA1 a2c990d4c66d53fc840d35e38f6f3cefcb2e7be2
SHA512 e5375fa45431aed3077eee7c5829ea14f3d22864369ac1dc7e05ccecf1720810bac5ba3c6c0372ae8c8175632c653a37e02a69ff2a268a7e5192afdc6932c719
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERahb:A3mnXoZjzyalJu4aewsAjmERahb
TLSH
T19A15BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 875KB
SHA256 d8ca0c1497fc3d7671296c5670b94eada6bf32ead11446d276d2b7d564c08a38
MD5 782430d13e20527c56719c13cc10dd2a
SHA1 90dfd9eec25e4e053d0e2f48dc0b58a4c81f4d92
SHA512 cf315cec9f5147c68daf037e9cb24b50e3b9ec99ceab468606f23d8743c854a879ca225ba53a5be7253d12c9974a34595e4e579e35c979c9688afc500b167fb0
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERapf:A3mnXoZjzyalJu4aewsAjmERapf
TLSH
T1EC15BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 875KB
SHA256 6810bf2de16469737c2f05ec54b1f7ddd0c1bfbe45e79bbf5853eb7f85f9d888
MD5 d22053aa34d74fecd2f0c04ec208c37a
SHA1 df279b6d5684255d3d349e1d94cb2e4d0871df1b
SHA512 cd1f8fdd71dbd7470153789db25ff1925292b3a3feab30e871c1b6e9e7d7db399a94e4fc326059181614189816816869da7305276cadaf8a30a1e43afcc22b41
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERaSK:A3mnXoZjzyalJu4aewsAjmERaSK
TLSH
T13015BF23FB7090B5D27B49705B65C712E7397C210B605ACBE3A88A591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 875KB
SHA256 1fde2e433a87fde8b638558851c4d22f5586705f4a6f09bb2e5a2bd2ece848bd
MD5 e39c9c1ebc1f55e406bb6ce31222b8e3
SHA1 42a9055694b9cab5116ab84ba6595f87d3a11ce6
SHA512 6cee764b71f6ac451468d93d70b6d77f0cd555bed662c967aa48ae9d8e70ff75f720b806ea96ec51e2d1dece398b083582ed201259d6e7e913c8750997a9806e
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERa3k:A3mnXoZjzyalJu4aewsAjmERa3k
TLSH
T12315BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 875KB
SHA256 422ad9edca0ac1f3212154402b07adc63275018c4def67a2d34e611e68779bc3
MD5 84f172a6e0d4fcecd62c66ccffab967a
SHA1 6f3cc148736ae71ddc2e0ef84b7e122c81bf2b04
SHA512 4b48a18770a6673f3640221cc96ae5322252872d7bb1be633a9c20506d768b35fbc22bba01f430e8d0fbe98014f664771f07c59667cfc674909bae3238ebcc43
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERaA0:A3mnXoZjzyalJu4aewsAjmERaA0
TLSH
T1F515BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 875KB
SHA256 ad8ec62001a190184978960eb5a34ff1bee80042fd9f7d92a64f5247d5dc91fe
MD5 6d64d176042201c93316667bfd252e58
SHA1 374d4d08a2716b1762574838340b461f6ed2e2f8
SHA512 34b5e8b870fd0f55c328d7bc0e2a9248a0dc01c97168d5b20f010b68128a970bcbad9043e04f7b6107b3377bfe93c669e70d31644c445036630f97b3d7e399df
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERab70:A3mnXoZjzyalJu4aewsAjmERabg
TLSH
T12F15BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 875KB
SHA256 34d3705a00c390494c2948b228a7687e8efd92cfef2146c950c6f4e488038dfc
MD5 a2dac25da9011b40cbf2a102e1438d1a
SHA1 c9f6506f6f7ec45d5964623804af31b8ddc41077
SHA512 42786a15e3a40e9676c8f595c962e73e9d8c589afb531cbd691b9acdf946820b69b294b33dc94469a8827add2a8ec3bb9b372049e840f2c18fc4e2ef915d2ff4
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERaWr:A3mnXoZjzyalJu4aewsAjmERaWr
TLSH
T11E15BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 875KB
SHA256 fd00ed1949dca48dca22c71b026f5e46e9954f70c5ccb333e2f8efe774b55c3a
MD5 c3f36fc2184ee9d23daacae3e247889e
SHA1 ce75bf3d2937cb36bfd2cc852917c9354fd35088
SHA512 b5976e1200a5235d4afba0569d4a834a496d8954b691b967b5250c03e100a3db3077ccc980a654b303575adc60a93251cd4706d67ed78713eb126ad43c9212e3
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERa8n:A3mnXoZjzyalJu4aewsAjmERa8n
TLSH
T18E15BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 875KB
SHA256 54d462963518865d393dcc76dfc58865660aa48414b9fea2dc772f37195ef88a
MD5 900f499f47b5275ab8f851e72f3bec43
SHA1 08a783fd582403a758a23517c71815a692cd58c5
SHA512 72c4a79f31a92b82a532a8989487f55f31e9811a367253743c5b0e7d23ae93e11bc4331d88c3da3b2599a054a0fb28b0bf4fd6e4996cd6b8fd36613e7fc94ac2
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERa6x:A3mnXoZjzyalJu4aewsAjmERa6x
TLSH
T12815BF23FB7090B5D27B49705B65C712E7397C210B605ACBE3A88A591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 875KB
SHA256 fc238ea6a80a8fb15914cd5902cd0521c80f7d09fb738e53d64f60a087cb7bdf
MD5 e7fadbda6b3e4c2dfabe0ac5ab77526f
SHA1 900865a98aefaf472a2198d83dc93b93c08e9986
SHA512 eaa5f790d5eb3032c491ca83b11d6fa53870bfb0ee6ff2c58baf370c80ed3d9548bee9ce22fbeabbe1d4710f00a36232388f0f56dcc8787a04d32ab4eaa2897f
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERa8A:A3mnXoZjzyalJu4aewsAjmERa8A
TLSH
T1E915BF23FBB090B5D27B49705B65C712E7397C210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 875KB
SHA256 ab5959b9f0663b4dfbcd85e6f018e618a6ce176cb00dd7d38f31ef72ee81344e
MD5 9f5fbf1b31a8eb88ed4438969157edeb
SHA1 3510d0e4ba5367664a395e7510f97f354b3e429e
SHA512 1b2a1a45cbef23e90ffe1c19dc68babfc27c47f09bc4b790b2d091d43951030976973b00f8074d04f13002c786b71dc3d11e3e42092671d50f47bd05a8c61509
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERal9Q:A3mnXoZjzyalJu4aewsAjmERal9Q
TLSH
T15515BF23FB7090B5D27B49705B65C712E7397C210B605ACBE3A88A591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 875KB
SHA256 40809ad56de812c25373c7b8958d7a66abb1361fea979ca28f7a4b5746891a39
MD5 e6a0fcc9f3d22c17acdf5a423becf062
SHA1 a0fce188c2a698e01f2d88ac5f67e2a68a837ddf
SHA512 6efbd2e3dacbaf5db0e1bcf466cacbfafd08278876306adfcf003146efd642c428fab1f8c8ae3ef0d2282f53a464cba9b6709e55c43caca2f9b4cb53351adde8
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERaQ4:A3mnXoZjzyalJu4aewsAjmERaQ4
TLSH
T10E15BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 875KB
SHA256 72b4a315cbe62b5c0971e9d334cb6ef251b53aca500c04e9377b208531a9f61b
MD5 85bd40b92ba87cda60436a46cda2a6a9
SHA1 afffc0d7eaf3d1c6f69637d272aacf6a9036e83e
SHA512 b9f240ba32762aa584b83a7c96dac24d7548cb23a1da5f12f6bc0ae10d922630ce701b6dad25034514fca10db7e4c1cf9d5d0f8d6a6ca27e7f15cd9da2d899b2
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERaTu:A3mnXoZjzyalJu4aewsAjmERaTu
TLSH
T1CF15BF23FBB090B5D27B49705B65C712E7397C210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 875KB
SHA256 e8e0e3e286634e0bc700591b17dc1722fd82de0e7d3437611eebc840e1f47af4
MD5 3d01704749e5b34c888fe4575598f5c3
SHA1 e5494bee36917a927ad033e5d1a89b3c94839184
SHA512 cc18f01d6d18138b4ba0158770361ce425f65229d27188e8efe0536060da520b9c4f53b03e5576fdff46dc5da21e9abb43741953926c974b94bd89e1c2175ebe
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERaOj:A3mnXoZjzyalJu4aewsAjmERaOj
TLSH
T1E415BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 875KB
SHA256 50a8cbe8b3dc73c42312d4ebfb7863f5bf91af7b97a277e20d7e35a2276b82df
MD5 45279096f19603580df882076b059c75
SHA1 0d090859741645687ab2e509e811fe6e57fcf232
SHA512 be0844f56d85deb0a30f3a4e549c5228a746167b63afbccc8419e7333ae0f69f3f54f658103544294e605a25253e4b8c265cdf2e29f4cfd5800134dd45cba898
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERa7g:A3mnXoZjzyalJu4aewsAjmERa7g
TLSH
T16315BF23FB7090B5D27B49705B65C712E7397C210B605ACBE3A88A591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 875KB
SHA256 3ef8b4f52f46dd3b123b28bcda7a74854e268350a2677e86d5463086ed988abc
MD5 0e689b1b2327154a53bd87d757959ce0
SHA1 94016e0cde9185063e9b73bb5646dc675371d567
SHA512 aeba21760dec7371f914e539ab3bb70bc8f575f34bda2a9bd3280511935bde894d213a099e71dbec5d689768090d4d1cefac2f7a300f37fec59c8c33e65e161e
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERamI:A3mnXoZjzyalJu4aewsAjmERamI
TLSH
T1F415BF23FBB090B5D27B49705B65C713E7397C210B605ACBE3A88A591F317C06B3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 875KB
SHA256 bc44e79abd5b74b0de159de8713e8c5e8c4d0764f5a70e179528f49cdd6d3555
MD5 ef46b81a151ef8d825d758d00d100da4
SHA1 92d93dafcad8cec9e74276eb5e239b66ce39dce4
SHA512 162df79fab70418724f9a78916459fc5c9df51f8545fc60b294ee9987c55356c553e6334974d00b5944f2db9b94fa4f012173d4b8b9aa0d39cd6584a7425d9cc
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERaUo:A3mnXoZjzyalJu4aewsAjmERaUo
TLSH
T15115BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 875KB
SHA256 c6301bc162865efe5f89139be61b0ec6bfcf0e13c7c1513a7cdcd51394966ceb
MD5 0bfd10afd805380f7e54a2643986e5a0
SHA1 4b716f5dce0182c4d4ea777d256cd70df8393d49
SHA512 760dc43088012e954f2a2934e8a4e623db9fcfdca4f127e1359640997e24e77616d6a687672af781c67ac928668003e0eb1577e6d8df984849b71418f0bfe191
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERa3+:A3mnXoZjzyalJu4aewsAjmERa3+
TLSH
T1AB15BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 875KB
SHA256 1080d002d1e037b0d489f98fb60a76e412cd7ef7fd8e90add4f688f8b99c7086
MD5 ab1e2635a1be7b55031c864158b8ef14
SHA1 b601b8ff754d2fc30ee07795233ae1dbf3fa8cae
SHA512 ff8c2c4e4270d7312f9351d9e34a933779029599c1e3bb8053bcc6d9566639be9233f030b11a8ae3b8bdef0ccdd0a5049ec30af34ff5442fa93ce01aa01afd51
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERaNQ:A3mnXoZjzyalJu4aewsAjmERaNQ
TLSH
T16615BF23FBB090B5D27B49705B65C712E7397C210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 875KB
SHA256 0dbbdb788ff572b13f26678badc4dcca232efb1186b128a9d0656e167b26f60a
MD5 006f0715727295a8930ce977852a3e05
SHA1 4ef630dbc4d38e45f14a2272b86aa161940324d8
SHA512 61d3b1cd5ac2e5774d7ca014b9931106e7c1ac4312030c930c4f9cbad25d15d2922160ab225ed4e6e30e02ee0ee7325dc2f5b1a94fe03b4c9766c8c8e84e01c6
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERaCX:A3mnXoZjzyalJu4aewsAjmERaCX
TLSH
T10515BF23FB7090B5D27B49705B65C712E7397C210B605ACBE3A88A591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 875KB
SHA256 3551ec3c367e5891a166c3d5617f836d4afa0749ca7e94e0f4a6fcb018822537
MD5 264830462fe5ee0b017207b217157f2e
SHA1 17554f55e388630564a9820bb17dab4d9bfe7020
SHA512 26ec28d17088d0cf942d428729fd2634eea9c835e08e7d0fc371d57eb6f57ed260dce5960d1dbe307ddf0b0c51236628afb7643c30b7c6d1c5df4d460e3c1b67
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERakL:A3mnXoZjzyalJu4aewsAjmERakL
TLSH
T11415BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 875KB
SHA256 7708ced145a3e067583c1fdb41b82df83177e9dcb7dc842382f57435cd793250
MD5 3055bc47dd6f1a13315281e173130a38
SHA1 b76f6a6bbc4f26a3bf28b0dec3af7d3ebb276e53
SHA512 c8340f00cd4458571393bdaea93a487b27909856df2826c90b7aa529b5ce745040f041e13a2204b20ed3489d627884eefacc1692350fb6b0645dc849677b6062
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERaAFC:A3mnXoZjzyalJu4aewsAjmERaAM
TLSH
T1B415BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 875KB
SHA256 6154109bf2f97d936d0e4bf21bcab496780f367e970f34e78e258292b7d08fe2
MD5 46b80a84b763757d3f7043be724f6c99
SHA1 448f85257ec6aa6b4b9a335b59e70b43aa23430a
SHA512 fe34329fbf4d83fe9442cc42c6089ab0996c733c60ea8d21b826c3d900d7c6e60fa358b1ef6e4d48568da1aec2f10e02f743de790792ab4cbd7de185be196cd1
SSDEEP 12288:A3ZUnXoZ+yPz5L8alJuvAwSfxL/2Dc3jDLLmt0LDQewsAjRkERahh:A3mnXoZjzyalJu4aewsAjmERahh
TLSH
T1B715BF23FB7090B5C27B49705B65C712E7397C210B605ACBE3A88A591F317D06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3212-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4244-148-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4244-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads