b7c5837e3badbae369a2eada54cc0a40119abfcb1a433f1b1462168ef55f747f

Analysis

max time kernel
104s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Size 901KB
Sample260805-smdscaar3x
SHA256 b7c5837e3badbae369a2eada54cc0a40119abfcb1a433f1b1462168ef55f747f
MD5 de71dba9f1eda642fe87926ee68a5f89
SHA1 eb622c8110b9b43352ac1810f1921066100fcd48
SHA512 82675f2ef43a1d6b7ddc64c0c8f658219dd2ee950be6e80c62ba753114522386661bb2549264f79faa828b3057f556c2d25cfb58c53baae14642f0b218f83677
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rof:A3mnXoZjzyaT4aewsAjxTc6rof
TLSH
T11315B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3584-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c536-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-33.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3584-70-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2592-71-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-570.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-638.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-760.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-799.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-912.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1081.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1137.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1150.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1329.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1343.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c536-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-33.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-228.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-491.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-570.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-638.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-760.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-799.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-912.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1081.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1136.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1137.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1150.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1175.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1182.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1219.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1329.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1343.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1374.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1381.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2592	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\SyncApprove.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3584	2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
2592	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_de71dba9f1eda642fe87926ee68a5f89_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3584

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 901KB
SHA256 b7c5837e3badbae369a2eada54cc0a40119abfcb1a433f1b1462168ef55f747f
MD5 de71dba9f1eda642fe87926ee68a5f89
SHA1 eb622c8110b9b43352ac1810f1921066100fcd48
SHA512 82675f2ef43a1d6b7ddc64c0c8f658219dd2ee950be6e80c62ba753114522386661bb2549264f79faa828b3057f556c2d25cfb58c53baae14642f0b218f83677
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rof:A3mnXoZjzyaT4aewsAjxTc6rof
TLSH
T11315B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 6b0fff09f9951a3d093d607022e609a020b716b39cb850a737bb08a37c979784
MD5 42d4308cf376e8c43f7e7a408f817453
SHA1 afb951206b7343ff1821a0742bb5413d0d768e04
SHA512 be7562ce6e999e123d622441ff9d8fb78ac9262799a6164d0d9b3107b79c92eb916cee11a775e195f962b053cd004c04f90eafa6be43e726fd9c66f824846b2b
SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6roL0Le5ji0hmxNrM:A3kMPljUPji0Aj
TLSH
T156658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 916KB
SHA256 5520a1488fc8155c0c10b4b618c9fe0a76922f627f60cc218aad4147b66012fc
MD5 bb56d8f2ccbd62332e71f9a0e7a8d387
SHA1 e75e947aabbbf5c0eb282547e992029c6b656fba
SHA512 674d6a5de50a9bae73988136b34a756d7f8bf90686636dfd32214e6e72b88c9641bc5944cdf4e905472e69d14d6ec2e06bf957e0c517563e6f30eea34e7737c7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6roNa:A3mnXoZjzyaT4aewsAjxTc6roNa
TLSH
T11915B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 925KB
SHA256 7c1e214626be8e0511c57c1cce0ca62b8ac4350d17c56abb12cb1efb1ec9fd56
MD5 40b9f41e48f8a7fef3ff8a15d981fe4a
SHA1 b43e8ee84f755f11d2cc0ec44c809a0d2adaa6c4
SHA512 9a566dfa2c344c48cf81a212a83baee43b89f180d02ab2b1f6587b44f0fcc4ab15781e9bb22727d63ed0242b46ea5318062a700c4e39b579783d8fc8df32712b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6roE6:A3mnXoZjzyaT4aewsAjxTc6roE6
TLSH
T12C15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 925KB
SHA256 2eb7b274091aede86be6d7d28da444ea48db73da1ef2598ecf810cad8c419fc1
MD5 45e7e86942b34204fb6aa9f939801bf3
SHA1 a9542233bd24c774e6316661efd43ca11b8dafa5
SHA512 a1d8e9f2c59c0d7f380d3cb28bf13e2abebe9744e20cc6a062bbc27cff47fcdde91231d2cc504a6612de489c723b900ddbbed9194c8674229380f9e935395a9c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rogN:A3mnXoZjzyaT4aewsAjxTc6rogN
TLSH
T1AA15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 925KB
SHA256 2327b8c98d6fad828c4adebfb3c09ecf310bc083983926873757fa0d233e94c4
MD5 e46c47a42a720338272ba775e647514a
SHA1 7a314be444dab12173c04786d9215a9680c76fde
SHA512 8e1d69cf8db6add02af3a56e1b6a6a3360351ea7bdbf6ec15668fe0b87edc5b9a5380d9759c87eb414b4f1f36afa5a72a1ffa38ea060becfca9e60f56cd2e040
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6roOf:A3mnXoZjzyaT4aewsAjxTc6roOf
TLSH
T17B15B023FBB090B5D23B49705BA5C712EB787D210B6056CBE36886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 925KB
SHA256 e3b41aeb3f0945ea1efa6ed1cb9c7e0163f87e6372c275c87a9d40fa4e3e83dd
MD5 ffc58f46ba1495414a11449a377db0fa
SHA1 f8e988c70100969ccf5f712f9ff1da31fceff23b
SHA512 a3e9f5693ca0f59021781b3281bb5c314710ccccef34ce4dce47f1f78d0377bd50b840b99c851662f42edc8cd81a7420f405e04566fd71ce5d9278d9a5097ebc
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6ro4o:A3mnXoZjzyaT4aewsAjxTc6ro4o
TLSH
T1F415B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 925KB
SHA256 a3bdb0b1d60da9658d74d614d12b60ee89fa9418ca0abe2c0595da77dcae3a26
MD5 c6c90369be1b046ebc3f54dcd0ed3f45
SHA1 54d19daeaa25fb8d0cefa5e4f4f7e12d129c1b9f
SHA512 22c584185f40fc4161a087205a85a6ae30b94b905e2cb86818eb9a112bf8a563aa85a9f98d15f7f81a32a8ed5a02de87f2c6a643f4b2de4b180641dc3ad0db21
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6roIu:A3mnXoZjzyaT4aewsAjxTc6roIu
TLSH
T14C15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 925KB
SHA256 597bbac63bdc7bf1e5309f488760804d932bffd6ea7da7082d02fefa310d2ee8
MD5 71851ea52c061a45b56484fc28b960cd
SHA1 f3c1b21567837370b741e041644335af35586765
SHA512 a4635737cf70549427fc3a49ed40a1a4ff2b549c48701d8371814ace8e15a88d3e866143327342a64258772c694499bf920e009a82cd637bc7cf67e27388e407
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6roc9:A3mnXoZjzyaT4aewsAjxTc6roc9
TLSH
T16515B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 925KB
SHA256 5c35e511680bb5c665fafe48c0c2c9189b8ec3e58be5d277875ffd0ff4b40e46
MD5 f50cad5687dec4f2f9c559a4df01d9bd
SHA1 629cd1defc44f91c1ce397e24fcf6ce1f66e3539
SHA512 67c578de456519fd35553968b58d7f17d1d5acdf3bef302f01efa353a5c10abaca9908ba667aa307bd18533845f588a7432c84337fcfd85ccf09f6f939cf57a5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6roEc:A3mnXoZjzyaT4aewsAjxTc6roEc
TLSH
T1B015B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 925KB
SHA256 8a6ac21e2d106f3cc387641e2aea8171b03d2206ac91d7e5a9cd95c9b7220495
MD5 981bcf8ef70ea41729da07c3a9d2204c
SHA1 18096ce6d2b77c724298e14874ad43e9c30f4f00
SHA512 931c30689387fc97190f2e9347c6a708e2b24af6aa3fa782e68386d32b6bc0119c9d5b0484c3824e48adccd7914c84301e853f597496019372ced9535a9024c3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rodp:A3mnXoZjzyaT4aewsAjxTc6rodp
TLSH
T14215B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 925KB
SHA256 813a2c5937ec7584deedeaac49d00acdc82f7b4f5aaefa903468db21fc8b4514
MD5 d01ad414f406d96bf35cb4679dc0e20e
SHA1 49ebb5a3531d1922fd569df108208e1aa0e6f65e
SHA512 adba358ca56e2aa848eba5b9f4983bb9b0cdae6b1abb920da8795bf123ac46219df4648a1fe7ebf0a94e839656bd97e28ac35870425f99cc05d65f182c839790
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6roi0a:A3mnXoZjzyaT4aewsAjxTc6roiN
TLSH
T1F615B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 925KB
SHA256 f47848439a142f24f9fbab586a004d1dd6463c2406ae2a771289b7054f156e34
MD5 29b827c1acc9216ae15b38f8d1b99c5e
SHA1 dbc0ec622402e6dfc030d7308904ba89b78660d9
SHA512 c1cfac3d8fe79fa8a81cf7e9896b97447e9267d564e045c46d8ee10acd6c85ff48d309390d545446d439cc725c2c4256596479d13b5542b4127cb2f4b30e54b1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6roGF:A3mnXoZjzyaT4aewsAjxTc6roGF
TLSH
T1B615B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 925KB
SHA256 45f3a0862c567862840f2224caa82b7f5a17d0c2e622a67180eb8f135b2cf0bf
MD5 cca269f1f0555dc95797557de42f0034
SHA1 0cdf314a39f40184aa43d59cb629363f894c03ae
SHA512 34043e373e1eca14115a66f2728ace01fe90b9c01da6e8e65e98ace6d10885ee1fa0c99f095061447bd6358850651317c03ff0972478e8e8258025d68c9d7d7b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6roTC:A3mnXoZjzyaT4aewsAjxTc6roTC
TLSH
T17D15B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 925KB
SHA256 0fdbd25d99d7940b5fa70578acaf9b1b4d650971786d5e9461eabbf7fd97494c
MD5 e7d577d370b41b044a92520c22aca029
SHA1 b948290e328f5a862c259a7595eaa6732129dead
SHA512 232b7cc250e219d4065c1e33364ec952b8af9818532aac206aec88b6c270a30adb56b378d901d7008df4776b7ffe603e72bd7563747d7af4e309b4310e3ab319
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rocw:A3mnXoZjzyaT4aewsAjxTc6rocw
TLSH
T18B15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 925KB
SHA256 f64b9e9dc0b33b45e8b63e8a6fae4c3a8ac8fcc1fa20280af334cd7d8cd6c5f1
MD5 979fb92ad2eca21e08ea1886ceeecc0a
SHA1 af9b06abc26b4eb800cec57bdaebc4b68e9ce302
SHA512 71e30d0e311e2845279d340657a00dcb2dde47a5f248b94a74892bc7ce933aba3f6cecd4e42d599f7cb608d23c41f74ad370617a062410a88c9722617bff3d96
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6roTT:A3mnXoZjzyaT4aewsAjxTc6roTT
TLSH
T11715B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 925KB
SHA256 c0ceda95d8e65cd281cb291c98905dbbd4998c15c9573b6145ebe2e7ea6acdeb
MD5 168d769f321a385f8405c09ff4fba114
SHA1 b27ae6b096f23d82005c1cc82247e4b9d22a1d1a
SHA512 c361b01372d2a7eea563ef9dc11cd1c94d1e7f80675de2868842bcc2ee46849f216f935cebba674ab291642f636472d2cf4b7cf17077265b03235829cacf8b7c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rolu:A3mnXoZjzyaT4aewsAjxTc6rolu
TLSH
T1C315B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 925KB
SHA256 507eedc01b087bce50baaec15ec48481484ccb33c74e96176c5e59bf44a47603
MD5 982c7c692fe9cec8a9b8ae7da8845c9d
SHA1 63ddcb11b15d4967720018a574221c6604857464
SHA512 93bf851fe285865d6684ac8fe983e86cc2ac6a1d475c040955fdf53f601b50703ab2d40512c9cbc9caa960b3e8902cc71799641c39b9c94fc3828271eb4f9dd6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rotb:A3mnXoZjzyaT4aewsAjxTc6rotb
TLSH
T19A15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 925KB
SHA256 7fc64b84649bc6f096ec329354ed3abf6e7426ebce5a967fa2e7fb12c9e62696
MD5 26d8d0bb39cdc8871a7d3e816f8f0528
SHA1 ee2100e65cdfb167f66256976eadcf9a04623949
SHA512 d73385022d3e2a7a11c63305078810cb2e6aac823604e8b1f470128848ccfa829b582c979ac2237b51d8e16ece94abfa6ee78f99f29674e63d079aaf81d7ff8c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rodf:A3mnXoZjzyaT4aewsAjxTc6rodf
TLSH
T1EC15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 925KB
SHA256 d42774a42a762e9c0e9f3e8fbd91f98a4f8ab92a65109e08bf13f47edf12588b
MD5 3a618cf863baf9140566398fdf9e8332
SHA1 41c0ee0958d4249a3a52d5e1d09358c22dfc2008
SHA512 88349e1d32b1ca15ae0b57838824c217f98694b7dc4555771052e903aa22c391dac809fbcb7dd31502283323671672427b2e533d76af097a0843fd420587bec6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6roGK:A3mnXoZjzyaT4aewsAjxTc6roGK
TLSH
T13015B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 925KB
SHA256 e6dcf50a1e796e791259b8827737d1d081ecacb93843bfcd7e75f3a14cde5b68
MD5 5c9c856147d9d2339dd7d430f73bef9e
SHA1 65be765d5d1da707d4a95c591b1179b1571f3c6c
SHA512 777b7adb3395742ca6891ccc735168a668ccd7a357292b995d12aa175cafef746333c39054c682b1009ff9568f5452ec7266f65fa1656fa19d36d6cbd8d99d65
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rozk:A3mnXoZjzyaT4aewsAjxTc6rozk
TLSH
T12315B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 925KB
SHA256 c58c6c13d18f482269466e2726efd0ab65607ff41f6a56597f88295262011786
MD5 ccf85e7ea2b7f0b6b0e4e2e19f1db389
SHA1 c9283ffb14641c5f66acec2ca964861efba6f26b
SHA512 2dfb2d50617d2ba499fe28147c9a3b155cb374130b42697f59518012135cd96b0462cd2dd36942b4a0e324ede8ee302de049ebcfdc0c3e4874cb34976ec06e4e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6roE0:A3mnXoZjzyaT4aewsAjxTc6roE0
TLSH
T1F515B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 925KB
SHA256 3bbabe35017d976d24f20d4fc97714f39175ba54e2347e6f401507d821a9503f
MD5 333a71d67fb1ac3e0270f36ee309efa1
SHA1 36810b52097efab2b528b814e84fee4d6d7bf199
SHA512 4592ccc3ab60b8a60fe5316444f868463b2772d4f9b8c755b83538eb34ee861d901a4c71cce75fed5e34df8a8cf609450a0390bf9e1cca2181ea85c449483de2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6ro/70:A3mnXoZjzyaT4aewsAjxTc6ro/g
TLSH
T12F15B023FBB090B5D23B49705BA5C712EB787D210B6056CBE36886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 925KB
SHA256 3018d378433fbbc88121d7722e84b5bfb0a6126eae50c747603b3a700046e146
MD5 971be8df0d80e75bba70fc08d9b3b98c
SHA1 5f06dad417425fc1cf08449144fc42c515a153bf
SHA512 47a952ad1bb281a86822fe000cec6342f0f582156f7efa70e047bb3e186e27d38388fba7dd6abae4f16568210db25a0bdd9c6e525e2753aa1948c7b87288ed3d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6roSr:A3mnXoZjzyaT4aewsAjxTc6roSr
TLSH
T11E15B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 925KB
SHA256 e5cb0772900c9235046e8341f629d9dda413df723b1d5ab8b55996dd858ddf80
MD5 8890fb66addf1bdd5cc2ff663615f0f5
SHA1 178f85e055a33d1edff2658934b5593962ce27fc
SHA512 7574b2af8d67068b237acb2a637232c382aaa34721a2166b8d11347363269269b64eea8dfe0bb21cc5bd2437c8d874ae23725f5bbe8a5f3366eac7c4094c045e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rown:A3mnXoZjzyaT4aewsAjxTc6rown
TLSH
T18E15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 925KB
SHA256 0a9d981b9da552450638583db3aab52c42749fd6b40ae8a24c8a1341414a256f
MD5 328935d57cd5078cdf5b61efb11790ac
SHA1 b955cd18741a3e71a71973e435c4990c6aa41845
SHA512 10baca4214f0514495d130493bd904a99d76c0a6962a8ec281b57637f7b6cc564ec0ec8d383420616ea08544a7cd700cfa26dbc4d40d4edf0c5d717e5cfbbf61
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6roOx:A3mnXoZjzyaT4aewsAjxTc6roOx
TLSH
T12815B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 925KB
SHA256 71e596cbfdd5e3d1aa28940dc2b752e675a3b030917d6618b7b4d58eaf88cedb
MD5 dfb1a963074ce2b81369b3a396a58c6c
SHA1 8c1cd706a42d19dd10379dd160b5dce7e1a8b9b1
SHA512 55e12bdce0438b4337f32139d79e13ac29efd931744ec7c5f707ec93d7c8d1d1c42c109a65f95acf5ce5c5a27478241e4fbbac4ecda690435caa6514dd913ec3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rooA:A3mnXoZjzyaT4aewsAjxTc6rooA
TLSH
T1E915B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 925KB
SHA256 ead5ad30b52553664e2d0f8b4c64106ad05f35bc55586386845609e69ade6554
MD5 d31667334fd2b06a73bae1bae01053e8
SHA1 30d36585b6fa89e1805ccb2d7fc8b46eba15db28
SHA512 2c34b5c3202873d0653653e48da1579070979a19e4f8cffa5793c03e32d2381fc76db2f73ed56c7c27bc5b12fe09e362c1ae1db0607fc3bfd5ef21e8412fe091
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6roB9Q:A3mnXoZjzyaT4aewsAjxTc6roB9Q
TLSH
T15515B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 925KB
SHA256 3a01bc16cfd1c7ef830e8405513fe44fc936906e1ab3f98fce88b208526cf6bf
MD5 3a635e3fdbb1f533485cda5b59fb983a
SHA1 52db6b23e5f73e7ee7a98ecfb3de75962ddea631
SHA512 afd48f0bf34e441a9f13d3df6b063f5a45ec5372ecbb63e8fff238ee5b9d516e6db126a515b6c562e5386ae1ce69671e06874a7ae69569496588fb9dd6eab15e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6ro04:A3mnXoZjzyaT4aewsAjxTc6ro04
TLSH
T10E15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 925KB
SHA256 fa978ef7da6be3da0efaf16dc7d4f68344a2a83b7f0d89199dc841b2cf34f987
MD5 a19c6f5d17d28b8bb233dbdf486d168c
SHA1 d4dc0ef4a37f18295c4960da5653552b63b8ba5a
SHA512 9f4445e4e1afe99e3d7db3c42f98700d739926a86c4f36c4a7aaa6eda41f5e1b8b80f1adab1dc1964f1840efef1f69cc9f8a04a1fcac9f77c5ea20c400b51f85
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rofu:A3mnXoZjzyaT4aewsAjxTc6rofu
TLSH
T1CF15B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 925KB
SHA256 9e9beadfa9e6b90c802f09b7adf0a44eddf21d9cdd9940e6880e761ec4474921
MD5 a72d0ec92a14776e9e4be8ce4e2cef25
SHA1 919cfe7cc44df89b461ea429eb02b4d7d6b44e00
SHA512 adddf908488fe1b4aadc7b057a1f73e23085fd2720b1b6a79fae366e2dec54921d82b93dbdca6ca196d2c3fb9467100ff198dac8c3db0f10269014ed26db056c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6ro6j:A3mnXoZjzyaT4aewsAjxTc6ro6j
TLSH
T1E415B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 925KB
SHA256 4ab2c4c211eb9ba096c7c425fb2f56f975c89c16171c5984580fcb86594ba21b
MD5 c7d8202dcd2338ae44851f9b8b20dc64
SHA1 e76b71614ee6116f389ccaba86bcf3c9744e97d9
SHA512 4914a1ca0c657d5bc9f008534975b06d6abb693efa928cf1782aab01a42146b8d6a68321cd9eb5b0f9d4319e18cd041d710c3cff2f93f85ca2ac9d0bc6e1d594
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rong:A3mnXoZjzyaT4aewsAjxTc6rong
TLSH
T16315B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 925KB
SHA256 87678d7a85f09202f2405d490359e2782cb03efa8486c316f01cd90563416ca8
MD5 1867a2213fbf1687e85fdecc50a79509
SHA1 59dd23d1463679a5bb59776287f9d810cb93f855
SHA512 91ee4009e310c07054d1c72d680ee65905fe3bf6dfa6a11df1ea111de8e122371c8809e08b091789137fc7d0bcf6679404f504c5e6d1abcc595c2528ca130e18
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6ro6I:A3mnXoZjzyaT4aewsAjxTc6ro6I
TLSH
T1F415B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 925KB
SHA256 0249ba051de5949f842ce517ab95325371cf60e25e75f0b18b8a4b3cc6d5ddf8
MD5 f5c664b34500cb5fefdca3ad3322949a
SHA1 922a107181860eba6c473f48fb3835009dadb738
SHA512 19a979fd3040650fdd87fccd7906cfca275f750877848bba1f6ad709500ae9fdf9b243342c13f8828e2aff5047c75002ed459c96e8b72d8c6110c7b5856cbaad
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6ro4o:A3mnXoZjzyaT4aewsAjxTc6ro4o
TLSH
T15115B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 925KB
SHA256 60d22dd9dedc67c7ba46448d778fb0fec3c9d640d22198ae18a90bf7b48785a4
MD5 6a02dbe6d05d4b83759dc52e52cbe9fa
SHA1 e85846938317be23890cfa9ffa200d83854b208b
SHA512 776d6fd4695924716bb39cbfb6060aeaf906965033f92aa108bd6031db2ebb9f78e35b420fb846603a7531685eaeddaf592ca2f377252ce442ac4ee24870d8c1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6roL+:A3mnXoZjzyaT4aewsAjxTc6roL+
TLSH
T1AB15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 925KB
SHA256 03c30a44a3648660ff2b702c66e108a96a6dc5dda124d66d3ddfbfb7d7deb8b1
MD5 7ef4a4070bd0b8b3074f7711aaa07313
SHA1 bc8f673afb78f171a69922ed05e19acb3a5296c4
SHA512 43a411ceefd2f38dce4108ed2eb88c5ae31ad453bc858c590516569c7d7acf22456eabcff1cb1b2bd59d1f998548529d111876df7638ef14c265fe6e2817446e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6roBQ:A3mnXoZjzyaT4aewsAjxTc6roBQ
TLSH
T16615B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 925KB
SHA256 0dd7dda655d0f1f6e6b3dc909063f9c1edbd69e8cda1db90d57ca6c25d401377
MD5 0b9c7e3e8db8670a70ecbb347d1adca6
SHA1 f8bd876ea7d2f64785838cce427d4eb90675cd8a
SHA512 0acc7da88fa5fe3bd2c0e456a3626d6b5dad5682f35e1dc187455a52f2d5abe791245e6ab0d2911645c525ef031c786739961c1a8763304992749e593e19e983
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6roGX:A3mnXoZjzyaT4aewsAjxTc6roGX
TLSH
T10515B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 925KB
SHA256 8e1756ced3cac6d3e5cf4d2f9699755f3628c0ec742c929933a0f4c943420916
MD5 82cedeb331735f910b5d127ca680ff67
SHA1 e3bc6454f57fd7094384780641bd7f419f2d9981
SHA512 d604c77abf236a8c1d4d98712366499b4a1fb6d863ec31fc7cd721de8fee99bc6c00c8937c2159a89f19b140bf360eccd6fe95529a11f84774625661ffa0438d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6roAL:A3mnXoZjzyaT4aewsAjxTc6roAL
TLSH
T11415B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 925KB
SHA256 b3ec2258b128d7ec111d4c9169735f09a180f89841bdc4a89ea6c932913db3f7
MD5 176b95363631b0d50387371e9aa72dec
SHA1 0aeb3c894f2de651d1ba7f9226fa4f8a435d0c7a
SHA512 e16d63ddabe756c83fb6304f1c019f46e5e827ffd216e8edf75a625153e40feb0684f619a19be4cc3857cd42acc18caeb2edc03f9b500d297e835d6c7cb69e8d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rosFC:A3mnXoZjzyaT4aewsAjxTc6rosM
TLSH
T1B415B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 925KB
SHA256 225a2203e711f0be82ad8425ba4a1b11020ac25cba49d81ab1de7724a6b3a56b
MD5 c5e254be0e906b275473a59ef995b904
SHA1 7af91e68e4f682eb0f962732a29f407db783f4db
SHA512 e25ff2663b90745a439145222bb84eff7186279c8524b0fa23e1d1b98428cc282abe6a682f364ddf05f1cde528469aeef47c5693d093697ed6468c31add393bd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6ro1h:A3mnXoZjzyaT4aewsAjxTc6ro1h
TLSH
T1B715B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2592-71-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3584-70-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3584-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads