59751dbf49949b5bd20c4a9dc931e425befdb85e306e0e95b92096204eedff94

Analysis

max time kernel
98s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Size 951KB
Sample260808-rrrpbsgp2v
SHA256 59751dbf49949b5bd20c4a9dc931e425befdb85e306e0e95b92096204eedff94
MD5 8d3559e82d6e293d8a087d232bba5bd9
SHA1 d9dfe57aa02dfd37555493084399284037e09764
SHA512 58d9bb9dbc2e34ae9584a9c23a487a0f77f16afa691766d38ecf5a8f0d9b262b20f0ed60f15d984cb0f084981a2b2670374b7f7f342296c00d266ce8eb8cd280
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRa:A3kM8lj
TLSH
T1A625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5952-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001b860-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2cc-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5952-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4928-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f6-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019844-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a54-577.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-664.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-731.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-925.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-982.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1123.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000400000001b860-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2cc-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f6-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019844-224.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-497.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a54-577.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-621.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-664.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-731.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-786.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-925.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-982.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1043.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1062.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1123.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1327.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1341.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4928	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5952	2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
4928	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_8d3559e82d6e293d8a087d232bba5bd9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5952

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 951KB
SHA256 59751dbf49949b5bd20c4a9dc931e425befdb85e306e0e95b92096204eedff94
MD5 8d3559e82d6e293d8a087d232bba5bd9
SHA1 d9dfe57aa02dfd37555493084399284037e09764
SHA512 58d9bb9dbc2e34ae9584a9c23a487a0f77f16afa691766d38ecf5a8f0d9b262b20f0ed60f15d984cb0f084981a2b2670374b7f7f342296c00d266ce8eb8cd280
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRa:A3kM8lj
TLSH
T1A625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 386b7a459b0219874d01979c56f62e0eac56c0db61ddc35ae0ed4acef247b298
MD5 aad64802073625f2270f59a8fa832037
SHA1 dbb0b0be2b1f8329f301c83fb845e35bb49dc1f6
SHA512 999e16107f1eabdf8177e2c4a0e5db2f1ec0bddeef16452a98c40d25b0335b6d319b7211f93f17fc56937d43aa7a1bf594c28aa48c139c88cac2f173ce21ca3f
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRaP0Le5ji0hmxNrM:A3kM8ljCPji0Aj
TLSH
T1EB658D22FA748275D177C475CAE2975AEA7138510B308ACB9398C76C2F237D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 966KB
SHA256 9ab0b44d1a40f5632668c8ca65ed7f3a36dfd571173bf541378e989e05b531ad
MD5 474986c21700b4601d529fc29bafab03
SHA1 dfa8c905525f8e347462fa6752e2285f169fdd64
SHA512 adb9897580c7755b207f6cb1b0e3417bd7cbe5a2fc763f581e123d5e398d230c3236cf00548dff87e7ecb48ce7df737a02930341e9fcb42df0cb89d943494311
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRaRa:A3kM8lj
TLSH
T1C825B023EB7090B5D27B45705BB58713E7397C210B605ACBE3A88A5D1F317C0AB3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 975KB
SHA256 7582f25a0fdd94c518d374f20466fdbffd8340c73f5b7aec092a0b04f4609e00
MD5 8c268357cd913c53bc3384e0daf8e34a
SHA1 244bfef80744c08535449a3e76f3023be5f988f2
SHA512 ea60e677b42125c55f90a50018e5c4e2e49fdf78673b2aedf9f8a7bc31c0a2b479cf7d7bea55fc403e28bff5999ee2c30f46ecbd5247b7a1707a6f34c644195c
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRao6:A3kM8ljs
TLSH
T1E425B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 975KB
SHA256 a7802507fa0bc182ebd77de1a37f2cc96360298dfcc61f2b87cfe59cb06d1f96
MD5 30a4dab1f85bb2e1f1a1fc6c99df9116
SHA1 4bcf2df3f67be78f6a8062907fc7f63155386f86
SHA512 09ed3faea69c95ad5ccfb58cc053b3ffd9da5fb11f7a3bf4db1828976968c5102f8376462f9701cefa63fbcd30a19b7639d1db1e43c6f389f0cc8da55a2f8b77
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRasN:A3kM8ljR
TLSH
T17525B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 975KB
SHA256 1f6bd29d1989c1595d54588d3aaa0e241eea121d09ad0c991dcd64434ef6d574
MD5 45afb1eff84d173cabc3d4d683827202
SHA1 f84dbbb34b149cae1758b1819d2d2fcf20f29e00
SHA512 bb286694440fd27e1513f65220aa3281a4896524ef735d3947c784ef2900ff99c0ea2f0f8f4508394776c07ea23dd9f334256e04ccced20709b4a17c93fec030
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRaif:A3kM8ljR
TLSH
T18625B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 975KB
SHA256 1a89ac676f02b38d02e88d3903911dcae2be56eb7096274af822560ee2c9558c
MD5 a79d14e0c66656a012d312e939c93a49
SHA1 7344b794ec6bea3c178cd147d0817d2f1203cc86
SHA512 3ab84bbc1f4fef6f759ddf8045c1fe852e11583373bba7a6b150c9f699c2becd955b574f41b03569d0434f1069fab658cf5d78f76b9d1ddb80806033a65c5752
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRa8o:A3kM8ljk
TLSH
T1A525B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 975KB
SHA256 13a645222d3a9f680abb8af170f6b0c10b130d7167dd11a97ea60170dcbbf092
MD5 44892311cbfd295060f1ac396044f53d
SHA1 2b161b244a78e48c64d6f64217ff5eb33fc8e17c
SHA512 a64ce87c1a2cbd18344edbbd0fbd5bd4452e1e157a677ff846884dc9fd6bd735360538395fd8d27d48aefef45cc6a9ac37ec263aa4e58e267b221a92d1b49e52
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRacu:A3kM8ljW
TLSH
T16025B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 975KB
SHA256 a5f09556bdc16d0fc0327f77e558179e6a0056823c11aecad495172704156594
MD5 f474d4d6f2ecafc33dd1990d66956909
SHA1 a35c0bfa4b2347f8f718e9472c750e723e45052d
SHA512 34ab1963087bd758d4f628d25e657b4cd2302c63f2d2b6eff4149dc19473e76a2f0d63c9e62149355115b39f81eca52e4e40d07f23f65f073c9e38d6e80413c9
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRag9:A3kM8lj3
TLSH
T14725B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 975KB
SHA256 c41f0efc9090f7d0bd6af123fec2b5c68d551f2cb317940843e03deb4185f4de
MD5 9ee4f4561a345ef77f863ece9d6c13d0
SHA1 78fc146c77f1833698b60357b71864aa8ac03b8b
SHA512 6773f9c7976fbe1880025f095f5d991d4c87ddf86acd12aade6878e2481fcb40a6182e082f90dd14aed14e98cf45afbca10b174941cef7eeafcf760c62f95743
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRaoc:A3kM8ljG
TLSH
T17B25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 975KB
SHA256 1dd3dec4504c20e02207e9a92b6325ba19d662a2cd03db61996f3a8e38342541
MD5 60ea2ea8e7264b7146e810e411b14249
SHA1 3272cc48c97ff1dc8095a561ca3a3dfd4a0e9ffb
SHA512 024ecd581262c698559ddb2da777b3235b80893d786b8a43267ff6ae7ca6833f4bb5b541d25161dcad75cfc9088afab9ab0cd4bef967db32aefa766892c98a36
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRaBp:A3kM8ljU
TLSH
T19B25B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 975KB
SHA256 50cd291391a1ed646625c9a1de2e7bfb4e45ce5b890e15cc6cc874273d33b5ea
MD5 9e44d37e45a8fdaeda225423d39a425e
SHA1 15f29be92c27caa23b5f92110c2ef55d16a0ea42
SHA512 af9dc8a662203f64506299c94cecb7a40e629c477f2622c68168d1a6454888e69fd559ceff72ccacc07b606e97ce98c7f7ad913bbc3d0ca984b3b0f8d13cfc81
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRaWN:A3kM8ljj
TLSH
T17E25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 975KB
SHA256 4580b180b680adc1a44f010ef01f57c8872aaeccabc9916112e5cc14b6733f87
MD5 b46976f824324f9bbd6e7035fa95501d
SHA1 4ef3e9465ef766fe7bd954ae1ee594c52040adce
SHA512 5a6d054112d5459e717b43126642200b3b1795e316ee38197de495bd88059eb25a440c1f2d0f3697ce6ab92f39e3ddd4fec52b1ec41a1ed34518d625150c85ce
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRaaF:A3kM8lj1
TLSH
T19225B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 975KB
SHA256 ff387324cde96e4e0a16cd49c655122fbc1c05896c0feb3679c6193cf217e584
MD5 a40b9c5e721107450138cbbac5d4c279
SHA1 8f25fd1827b6cc4e39430d0f23ff339dac74e911
SHA512 92283265547f938a1c46b9311c138cb253e95c1b2a354d5ddeafc624e20b88dbc6017d4f252dcd51fbc62454b9844c61573f290c65807b06b16234a4601b8fca
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRavC:A3kM8ljZ
TLSH
T1E625B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 975KB
SHA256 dc1da9ba6762c2d1cdd769fc8eca53732e64fa31369cea0d5bdb2b1ceb065674
MD5 f1dbe8a1ddabefc32da9ec02511e03f6
SHA1 02ae6366bad262b5c89529cfa101266218f47c47
SHA512 43728cc4c6eb39a8f9889770497cc22be7bcb44d349ea8dffe034a9abb47f86f686555925a5c0d45d8b0c5636543880b240ac664e67b88307727faa702b96b69
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRaQw:A3kM8ljE
TLSH
T1A225B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 975KB
SHA256 6f67a5060e21850164c0663ec1044d021c7036a5f6a05828188d94cfc978fafd
MD5 394774fda5013e4cf535dc5a466d769b
SHA1 b9b834de1ba7d0b00405c9e486d6a73c14944e99
SHA512 6bd9cce3a84ad66eddaa042f66c5ccd2e40985f64ebd8acb4a88b4417fda25077e4a9fe0ef76c1f8f8508e0e181390e79dc1241899792d7ad84fd72dda375f56
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRavT:A3kM8ljs
TLSH
T10625B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 975KB
SHA256 60740f8f8d5d4254a9a94e58fbf6b6db0335a1f7123307cc6fa1563024bb2568
MD5 601ec02bc958292ce416dfbbd3f2a787
SHA1 e10788431c1c5e9f1be5a38a4bfd609878bb40dd
SHA512 442fb92e2a304881cdc39e1e78bcc3b75bdaa4efeb13e1e49efb5843a8d2cf4d84cd7b13ca9bd9423872bf54de7ed195c7e6f32c6bf4326b6f48e39a82e574e4
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRapu:A3kM8ljL
TLSH
T12C25B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 975KB
SHA256 db77d13bef4f5f5cfb7fadc2534e8c41b90289b58f37491e01bebb11b2d8c54b
MD5 f04597d9f34f28d652303451b77f9bc9
SHA1 d113f1fedca55a7172a132f9f83757121524c3b0
SHA512 dd5c225d8bcde0b046ba6678d51f865cb7cb3568ea583daed0e6d19ea080f5dc8833f87ba96a746331285432947c05446b50dd4d732681fe6dd52fad28502948
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRahb:A3kM8lji
TLSH
T18525B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 975KB
SHA256 c8146ea47b56d4e252c5c190e6c49d060bf16c6cc4ed477279cd8ffb800a1727
MD5 05b742ef7df74df7bd1c2c11d925c355
SHA1 a7df73226a505723817216cd1c4c23b505d8ebf1
SHA512 27c92d36413253a089b88d8ddd8054322a66c0550090c2b53e798550c091baf5fbcbcf0aa63fe564fa71642761486610df5cc90e2846a474f71d8819db0af3dc
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRapf:A3kM8ljC
TLSH
T11D25B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 975KB
SHA256 292f9f227038c3e71a53a841ec2b96ce7e2ddeb43a85dfcf68e8f0c30b279c80
MD5 1bc5928b06899e70993b058d7c6d6f34
SHA1 6309c9ae293f1119e6b6a0e5a59d7e36205fc1a3
SHA512 9b467bcb8d0cf25d339a911498e35e187efbbb2272ace5f4dc8984ebc80b5dff420f970ad12b6fc0d07f24ebab9b35c6236048e0553ee5f88836f939fd9dbdc8
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRaSK:A3kM8lji
TLSH
T12925B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 975KB
SHA256 d586a6db5bfa541a88649093a14df377cc31e41f81042cd22cd96bb5ff248f30
MD5 6e26ed168629bfa8c67d8887c78e92de
SHA1 42b2545d587d565c35ddb202160e8d869d1fe05d
SHA512 32219d72f8575c552cee8e8ed06541e2251e63e09c9b1ae65531a417f55b66b5bab5448f1d31e9232c08694a616be06e175bef4cafe727363c4a1f7e2aea594b
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRa3k:A3kM8lj3
TLSH
T10525B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 975KB
SHA256 ee3409617595c5befa4e789884421f3fb2c794801cb0f37b6aeeabbf50f7c5a4
MD5 957c964c9c5eb14a6e915f8e0a6886b1
SHA1 46a0b2bc07ed695f30665da6ce1a71d5135b376e
SHA512 339d006d01762c37ba06fd910ef824fb8e854432f97c32adafe39aafe9bf65c7d9d20470f83b7f984b31c719ed5a29163079ac1f48590383c3635b4f6edd5b26
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRaA0:A3kM8ljW
TLSH
T15E25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 975KB
SHA256 e51475f52d73b74ac7d09e359b5c0fb70d314147f4d572351a67add58d33ee0c
MD5 d5ce5570d3effdf1c4930ec20f647dd8
SHA1 87b2c1906d3c40a550f2f7986d57d3cb96ec7a7f
SHA512 4805b2e5b322ca36dd17eee924978dd88de93d835e4d1c50908a15ebe1a5edfb06e33024903ea69fd44f3320e6b73fa070edbc6f48e84943d1b32b3239aeed0b
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRabg:A3kM8ljv
TLSH
T19E25B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 975KB
SHA256 847e1fd007a0ae0b7db458f961030d1f6436197706969bb3d059a78a6902b181
MD5 12d8037f6fc96e9135e2b936647a8c20
SHA1 3f5d95e79243a36992fd8bfbefd835fc54666577
SHA512 40fdcc2e5e95ab927af15d28fab2b03cac6dda0e302cb292f9b747f696194c504ce82cccdc90f00ea06331105a70353f7694ad47ee5c0e79a63c57fa964dc805
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRaWr:A3kM8ljJ
TLSH
T1FA25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 975KB
SHA256 19bab2edabf9d494d15d3f527b0be09346365b83ff815fecc04cb30ad7175fa1
MD5 55a9228dd2f6a480ec6e2490340665e0
SHA1 6d4e59d4365e8a88760a7fb2fce85f4acae695cd
SHA512 de146c301e8dc39b7095b77aeaeba78197220f576648c01ffd215ad2553915343c71aae1892299eada3b890ac9b8d50da12b154d0b378af34f51046d2a3af2e9
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRa8n:A3kM8ljj
TLSH
T14325B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 975KB
SHA256 f83f7446ce1eae6640c19879152980050c494b815591d809425cfa5f43bc583d
MD5 c724883db1418ee07c392d0637348be2
SHA1 396ed6fd85f39f12d119ce29143d057a38181d80
SHA512 6da73db07fca52c1c3f0a3532f7951882f55e8df751d7c287e5a8f834f6faad75beae8723562aee42edbc77724f9b4ad954ca2d87840af690b026d10f318d0ce
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRa6x:A3kM8ljB
TLSH
T14225B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 975KB
SHA256 053dd7ee31ab4ef847c6abd7ea7cb7c357270973b258c55d56050e7004bb7884
MD5 ba7686ece3eb7448beaef04073a3346b
SHA1 742a5cfedbf31bd7942198c4e7e4e3bd7b8c881b
SHA512 9ede6d8e066c63e660c53b1200a52dd0784c0b230a80486e04e06598e28d572b51f6ffca4747f4c70436fb8e97bbf4f2a11ff9b8bb267d6f19288e76e700a326
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRa8A:A3kM8lju
TLSH
T1F925B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 975KB
SHA256 6eaa7191cd260ffae91e9702d5ca9bec28bb7ff4c3887afb13f35f84e0cdbe20
MD5 2e916bb3a6a43b750497151cf3d2f7d3
SHA1 5071919e1de19ee81922bcca9ad0a9564bd01bb0
SHA512 f4c8981943e4f9ad16c2e0dee7201b9d98006b2060f9e85b9c50b2d6584d7ec6283cab5a024f45c190d84125b9c3f58069c5f7123d74c04bb843713e709a0207
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRal9Q:A3kM8ljz
TLSH
T1AD25B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 975KB
SHA256 eca8718a74e556b81ceaa59e55720453392fdaf00e74eda6b9c2109f6f7698ee
MD5 da8b80a5e448712eba6d25ce26531f1a
SHA1 57966df2d4b3793cfb5aa69c708cb81ca93fb38d
SHA512 39e4a9a65c41538058e464fe92553a3d0bbcae371ad20e980327eb1ebf1299eed4861b82b22fb97db8e715cb8fca9cdc7190c30363fa227445ef530291937119
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRaQ4:A3kM8lj0
TLSH
T16125B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 975KB
SHA256 48ad5db503a97d74fb1aad19d022291e835c4973ae939a6de52a74ecd5f4b0b0
MD5 d005f9b9901adf3ee1ac4e81142ea37c
SHA1 e02d39ae5a258ce21ed768c8598d771cce096808
SHA512 d35da07b8d0e2cf53e703bb0696d73892f936ce0c48e2b5311b68d5fe9c498575fe0ed66df4b889afd9b159adfa6c85fc7ff360d6e7d5789b0815b543d6d1de0
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRaTu:A3kM8ljl
TLSH
T1C825B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 975KB
SHA256 111625463f57fdb9994108511e95b86067088975c557937246c67c1c3499ad0f
MD5 bd79526cd92ebabd5ba59f61b9f26ccd
SHA1 8fdeb2ec5564cbdefb75890b6c8412a9e59942b6
SHA512 004d99774d50b8003a13b49b1e99fed5e53a274fe5a24b1a2aad96b9ad182651856f348a52a153d63b9ce7e88f22e7faa65c7d921101ca03bbcef3206d526029
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRaOj:A3kM8ljn
TLSH
T15025B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 975KB
SHA256 3d032b109373c9e22df129f2d772be7c5771ebce9a37140d1eee4feb32ab1dff
MD5 370a2a928f4f78287c3bbd17df83b45f
SHA1 86ab3aea4002dd0f81f41ee3ff03c9f7ab1fdb7b
SHA512 87ec65634e07e347315e1b7716d67401daf9c05372ac72c1131f10fbde447ba937d3a7096ddb6a37d5798d8f93498a57f3613af28cfa05451af341bacc0388a6
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRa7g:A3kM8ljP
TLSH
T1BB25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 975KB
SHA256 ff1a19c9cc9e034e36af41655566947e9d4f953b8e90df71eb4c3091edeb437b
MD5 e2c9c92498f642e4d76bc3679119ea5e
SHA1 f6d56da58cd55d00beaa6fa689eceb6f8aa8bd12
SHA512 2f208417d09989a0184d2fec0e0e41e324452e2a3cd5911c6a36e7299d7e0ca253c9c6a52003f4c1ed974defe4d85cf18308aba1aac7a6582d044484f6972da3
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRamI:A3kM8lje
TLSH
T10325B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 975KB
SHA256 f19bc9327939dbebacea5a4b8988b947e3a372fcff9cd33463c9ed1279ae775b
MD5 043654860fff8d044026ca430147a3a1
SHA1 2e91d9d8f0d48e819c885229238d0a98c2e9cdaa
SHA512 efc0fa5b65960c88de33d09a87a908b50c2fc569067493d3a4407b58cc5776f6b7bf8eed2046dd14437419d10c6964450dae24f727a5791eda33a0fad33674c1
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRaUo:A3kM8ljc
TLSH
T15725B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 975KB
SHA256 64433a80f87f83c2457c309441864bfa606d3d4e244c91b80fd9fa60411b713b
MD5 8496db36449d11742dfb1b25d9639962
SHA1 a567fee5621c92bb5ea87a85198d654797ce1403
SHA512 b5fba81e089a0583fa1f3019b6c3543224f66253c007ec9c671422667a85eab2bf456241cf8dbe195feddbe68d5509a60f4615813d0669388d48d58ba0dc02d6
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRa3+:A3kM8ljR
TLSH
T13225B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 975KB
SHA256 9124a36b6f3453c824438e349c21756229f23fafac1516fa2d0ec886ef713b40
MD5 80e8515530625ed967d87917bc677a7a
SHA1 6556e85db465ec1d446534a109f0395e522c3381
SHA512 e525a932344514d60cd663860759856dff53ca1b2899164b57a68fde763885ffecde2f588872c7b5a7e1f9300b43ceb81289e89a45583d8f9f2c8e29f71cdadf
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRaNQ:A3kM8ljR
TLSH
T10825B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 975KB
SHA256 aae03637bfccc571f80259b9a3df49aadbb12a671c849ff17acd1eac5d9c3dc0
MD5 73640bfa3e71923febf3960526adcc91
SHA1 1e4bb509de441760063bf2c10e2ca6f075970da5
SHA512 ce5f44091dc0eed1d96c69896a315cdca16a14ab03f1a6d2f241635a8736eae64e90a4feafe13476ed9955885d5bdcdce1868d80a76fe61080400913eec1992c
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRaCX:A3kM8ljd
TLSH
T13925B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 975KB
SHA256 06f2cc5d8fd3cbf13ff11bf956fe88634acb5bf95ecabd947ce8040817da35c0
MD5 055945b75998cb52b06b11bb1bcf1800
SHA1 f834f8ab3d0e3db61e3bd9c3963394d6757b133e
SHA512 956590fcee99f8438538a908c5614e13ace0a91b6f179308bae4886aa0a895184182271351072c953d302ec653a5d38f31142dbf3e81d4a95e46517405decdc5
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRakL:A3kM8ljf
TLSH
T1DE25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 975KB
SHA256 142bdbc44a4f237294801c88c5de86459edb249d280d966d7acc5241219f83eb
MD5 41eca35f0c30a169e12ee1985d4ce8b8
SHA1 3eafeeed219a2f014acb6777d04ab0efe7a083e6
SHA512 a3ff7ff288a60de6ef0524269b2fb7717aec0fc78babfc8ad21993ac95669939384ef5d00f1818538b5d692524c3fadeedce890e1f9ce6259fa4cfa3d7e4d37b
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRaAM:A3kM8ljq
TLSH
T19025B023EB7090B5D27B49705BB58713E7397C210B605ACBE3688A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 975KB
SHA256 1fcdb2f0b103159b2c3f8c31b82f6177378aef867972d59fbe73e15528ee839e
MD5 47aa44f3935f9df8a2bb7d438c510fd2
SHA1 ae512210a074b6c00f17545de2e47c545aa8a394
SHA512 46e3e11d3874befeeb0e42d95a9cd05d5ba11ba4bf36d770e47e887c50ed2a72a4244205dce526280a95e764eab53ddf2995a42d3cc44eb02f8353afb9f156e0
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aayaRahh:A3kM8ljk
TLSH
T15B25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4928-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5952-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5952-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads