044fa61ee223f54651c9f6f5a9168d8c032f8a05a8564eebf2a44d0d38b4ef0f

Analysis

max time kernel
105s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Size 1.4MB
Sample260808-r2jfpsea29
SHA256 044fa61ee223f54651c9f6f5a9168d8c032f8a05a8564eebf2a44d0d38b4ef0f
MD5 38ba5bd2440c2ba145fa5c3b90428c31
SHA1 64fd98dc5822d5abd0cc4ad83f4bc0d5c22c4b13
SHA512 8e68efa30fab5995e96e7eb67f73e5969a0c95d672e2d5a8e214cab3e9693d576609ebff3a02f7849c5fc235b808d0f0fccf90739bbba6afe675cf13c58eb3d8
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNase5jcAkSYqyE:A3kM8ljLpYq
TLSH
T17F658D22FB748175D077C4B5CAE29756EA3538510B308ACB9398D76C2F237D19A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 7 IoCs

resource	yara_rule
behavioral2/memory/4148-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c586-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4148-165-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2912-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0044000000018a5b-540.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001a37f-1022.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c586-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x0044000000018a5b-540.dat	aspack_v212_v242
behavioral2/files/0x000500000001a37f-1022.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2912	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	patcher.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4148	2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
2912	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_38ba5bd2440c2ba145fa5c3b90428c31_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4148

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 1.4MB
SHA256 044fa61ee223f54651c9f6f5a9168d8c032f8a05a8564eebf2a44d0d38b4ef0f
MD5 38ba5bd2440c2ba145fa5c3b90428c31
SHA1 64fd98dc5822d5abd0cc4ad83f4bc0d5c22c4b13
SHA512 8e68efa30fab5995e96e7eb67f73e5969a0c95d672e2d5a8e214cab3e9693d576609ebff3a02f7849c5fc235b808d0f0fccf90739bbba6afe675cf13c58eb3d8
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNase5jcAkSYqyE:A3kM8ljLpYq
TLSH
T17F658D22FB748175D077C4B5CAE29756EA3538510B308ACB9398D76C2F237D19A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.9MB
SHA256 bd54f1c19c3385a7c8c5f222b20455fd17123fb8c9b273e2291d87f2462b8125
MD5 b1ca7d4c14680bb084756f6a6978bb33
SHA1 e0a6002827a82ba28d68e9f903bb5182c873a894
SHA512 ed7fba649018779e0c7b3697c9e2c772d91d69c7a7e0157b10d0bc9ee88f7c527d464c8d888091c34175f142ef933636c50a3d49368d33f60853a46cc118b262
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNase5jcAkSYqyED0Le5ji0hmxNrM:A3kM8ljLpYqjPji0Aj
TLSH
T15F955C26F6748275D073C0B9CAE2A75AEA7134410B308ACB5395D77C2F277D29A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$
Size 1.4MB
SHA256 bfb34a87eeaadd34961baba285a0cff5a3c72830e4997fbb4317575c3b7c36d2
MD5 ad7f37e8f9f19dd5ecb425cc9a027d58
SHA1 91d63c56c23c2f73443e77379e0f767c270487e3
SHA512 8f329c4ded5024cf2982c85227ebf62b84b9a74e6215f5940dcc493c4f8fb273fbb657b003735f709b3758888ad0abb7e48f7223f2bf262c2e273e3c73ce0d68
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNase5jcAkSYqyE9/:A3kM8ljLpYqJ
TLSH
T1D1658D22FB748175D077C4B5CAE29756EA3538510B308ACB9398C76C2F237D19A3A772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DW20.EXE

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
Size 1.4MB
SHA256 782519266d9e20e24de1ab4f982e59a3c7c0d809381365e586df328aaf91c4ce
MD5 f30d911907b26a0ee43fbdeaf972a108
SHA1 5e865ce2dc3ed05f02b794d9a2ec409ad814c51f
SHA512 363ae21aa982ced6fce36b9903f921ab59dd8b3917d13ec753f1f574f8bd48e93f1751dc71195c1734aa91d28fadcee67b5112a3fa1afbe795a19532410c3aac
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNase5jcAkSYqyEuwE:A3kM8ljLpYqk
TLSH
T135658D22FB748175D077C475CAE29B56EA3538510B308ACB9398D76C2F237D19A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2912-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4148-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4148-165-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads