7e0edc33e5fd9f9885f84ab802268d1c9d2129efb4744afa02d5fa426946a8e2

Analysis

max time kernel
95s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 19:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_d547e5de6dbb10f14ca1104de6752c34_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Size 946KB
Sample260809-x6sg3avamb
SHA256 7e0edc33e5fd9f9885f84ab802268d1c9d2129efb4744afa02d5fa426946a8e2
MD5 d547e5de6dbb10f14ca1104de6752c34
SHA1 1c453a3542d24c585422a395344cfdaff2b486b5
SHA512 4aefea33a5fdb5e0f4559d54bdb85c40219ade75345b6f3baa0cd4480814b3792e79ded0ebe2cec03b2e15a5cd5ff0a295a5e61b4dcad8ac9384fbff501525a3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Tia9:A3mnXoZjzyaEFoHaewsAjYaEg6Tia9
TLSH
T1E125B023FB7090B5D27B49705BA58713E7397C210B6056CBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/2440-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001b815-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2440-94-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2008-161-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-574.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-611.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-691.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-778.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-815.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-846.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-910.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-924.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-943.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-945.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1000.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1092.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1160.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1210.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1314.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1334.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1359.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1394.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001b815-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-57.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-234.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-489.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-574.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-611.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-691.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-778.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-815.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-846.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-910.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-924.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-943.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-945.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1000.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1043.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1092.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1129.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1160.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1173.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1210.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1314.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1334.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1359.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1366.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1379.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1386.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1387.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1388.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1389.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1394.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2008	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_d547e5de6dbb10f14ca1104de6752c34_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_d547e5de6dbb10f14ca1104de6752c34_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-09_d547e5de6dbb10f14ca1104de6752c34_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	2026-08-09_d547e5de6dbb10f14ca1104de6752c34_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-09_d547e5de6dbb10f14ca1104de6752c34_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-09_d547e5de6dbb10f14ca1104de6752c34_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-09_d547e5de6dbb10f14ca1104de6752c34_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	2026-08-09_d547e5de6dbb10f14ca1104de6752c34_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-09_d547e5de6dbb10f14ca1104de6752c34_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-09_d547e5de6dbb10f14ca1104de6752c34_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_d547e5de6dbb10f14ca1104de6752c34_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_d547e5de6dbb10f14ca1104de6752c34_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2440	2026-08-09_d547e5de6dbb10f14ca1104de6752c34_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
2008	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_d547e5de6dbb10f14ca1104de6752c34_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_d547e5de6dbb10f14ca1104de6752c34_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2440

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 946KB
SHA256 7e0edc33e5fd9f9885f84ab802268d1c9d2129efb4744afa02d5fa426946a8e2
MD5 d547e5de6dbb10f14ca1104de6752c34
SHA1 1c453a3542d24c585422a395344cfdaff2b486b5
SHA512 4aefea33a5fdb5e0f4559d54bdb85c40219ade75345b6f3baa0cd4480814b3792e79ded0ebe2cec03b2e15a5cd5ff0a295a5e61b4dcad8ac9384fbff501525a3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Tia9:A3mnXoZjzyaEFoHaewsAjYaEg6Tia9
TLSH
T1E125B023FB7090B5D27B49705BA58713E7397C210B6056CBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 dae6d9737c1cd71952d65ce99d5e44af429cf8ba944ae727d245cffd629bf356
MD5 63dc9822a5fc7456286ec72c4e13b4ac
SHA1 9e2436892fb0d8c567fd679f7af3b9c8ecba8be2
SHA512 d8bbd4b16c58628bd4e641b07245283bd33d46163ea07d834e519042f7bf0d6f3e22ceba7302e852119d4476558aa70206615d270eea5538c999bd545a4873e9
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6TiaJ0Le5ji0hmxNrM:A3kM8lj8Pji0Aj
TLSH
T18C658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 960KB
SHA256 b57e0100c2c9b59afb93e25b7cc40aa3e855a09d54bb5fed0cabe562492b03ea
MD5 8772a47ca3a688caaa3ec5489ac55816
SHA1 8459e144ec8d0016e9016e69ca141afad5d32652
SHA512 e4471bc9cd5165140ccc144f453d3c226912b8ac8035cca1a654f92fb9a925e7d0296f30b357ccabffaca5767c3c1d017a6c051e61ca73f9bc9c06bd3a541f5f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Tiaba:A3mnXoZjzyaEFoHaewsAjYaEg6Tiaba
TLSH
T16325B023EB7090B5D27B49705BB58713E7397C210B605ACBE36886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 969KB
SHA256 f6b921957c57862daf5daafa010a75c81a2182251ded459e03f222f1f7d50a14
MD5 6f49e7727321f1f48de6f1cbbaad09d9
SHA1 f3e82ff4448812291cb4ae9e00fc5606230ebed1
SHA512 e154b6f4cb19a1515b521291b4ae89537468e3bd0bc771d6490bbe58a94ea2748defb5e01a9e324ea4846fceb43b8b4fc1d8b685192c7079e71f82824e688de8
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Tia66:A3mnXoZjzyaEFoHaewsAjYaEg6Tia66
TLSH
T10925B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C07F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 969KB
SHA256 bc136ad75231c463924b76e112f5bfd47f9022c1bfb2a21a5c82bc972b9be292
MD5 5c6a82c4a03bbe5ae3bdae9cae74b8cf
SHA1 928583c7f4ccbfd8f8cb0fbbed6752dd8cff188a
SHA512 e86ae196bff521418f7e29ec7224d4effc337765c7f151bc8520e48cf7c72f17400cf9d3cfee821ad9fd7462aa0f4a44cca56d6ffe2a4f82d5ad5789fb44e8b8
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiayN:A3mnXoZjzyaEFoHaewsAjYaEg6TiayN
TLSH
T1A425B023EBB090B5D23B49705BB58713EB397D210B6056CBE36886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 969KB
SHA256 6d95236687166eeed9724b75971f0435bb45e6a82deeea41bb80d0a4f854e0a7
MD5 169893ee57917cc0a04f776db5eaba88
SHA1 61ea272bc4a91146e3793525c46ca53f7d1ac3bb
SHA512 3ca6e67c3af005c821080510aea448caef05e19e19140df503c997b05ed738cf0c0a4da7c77c8d5c585f386f0825aa51850622f55a0325e1db5be5e0dbf97e21
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Tiaof:A3mnXoZjzyaEFoHaewsAjYaEg6Tiaof
TLSH
T1A325B023EBB090B5D23B49705BA58713EB397D210B6056CBE36886591F317C07F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 969KB
SHA256 9fa7c22f9241c14301a7f0156b2613f906965fb93f26545ff08c9e3821e85c77
MD5 a3c80fd0095b4d1eb064a15fac5b49c0
SHA1 7ac559d039e810f8a1d2516bf693b3a2305dbc72
SHA512 52b522fdc4e05d892c33951f2214abacc813ba8355c0beb01544b0186daa6cae9134ca61279437d6f1a0c656965505b2ad090fca7ce6eb6bff1da7cb6d67dbbc
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiaCo:A3mnXoZjzyaEFoHaewsAjYaEg6TiaCo
TLSH
T1B825B023EBB090B5D23B49705BB58713EB797C210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 969KB
SHA256 c25fb17546cc46ccd134815993ff5176f1c1825049fbaf53ec1e1cb8d3a6fcbf
MD5 cae1659d94fd2f8051222a09bbaa20a6
SHA1 60118d5e094a92044e4ada24f8c0bdc171af2fbd
SHA512 826eb58855e72e77d8839bcf274767973def99f76c846935df95ce73876c7da7aa5aa0cdfb011ca41e26469716d85a148400f7c0064f659ad482df7cdd48fb9f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Tia2u:A3mnXoZjzyaEFoHaewsAjYaEg6Tia2u
TLSH
T19F25B023EBB090B5D27B49705BB58713EB397C210B6056CBE36886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 969KB
SHA256 fdd7bd844d241721b2e8fc1d6e7bc74884bed79db374f038c9bf06cff1e19bb1
MD5 86ad28b94cefc66253ae77edb6e0d99b
SHA1 198d700e949de146b36a71e07a605a1219d836f4
SHA512 b800e11b36ae1d57956a9c76a2009a00597a8a6821809e18337204388317d6025820bf545a4ac77dd3836f34d0f024074f800bc5ef6fe235557c81e8596fdd17
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Tiaq9:A3mnXoZjzyaEFoHaewsAjYaEg6Tiaq9
TLSH
T1E325B023EBB090B5D27B49705BA58713EB397C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 969KB
SHA256 50f8046cafffde8c14c4465099a9774af0877081ea29f1806dd2e82df6091644
MD5 e1b51366cef361fa8ec27f20b6f18b22
SHA1 0d03eab5b619ed38e3582c5c689b0bed5ec7d305
SHA512 67e207fe0712f0627d7d6a8f763eb061019d7630d7304ebf38e7f0f15b130ef9fa5e0628a4193463259c2563a554075f496709922d8f063f5f6154e58683b571
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Tiaqc:A3mnXoZjzyaEFoHaewsAjYaEg6Tiaqc
TLSH
T11D25B023EBB090B5D27B49705BB58713EB787C210B6056CBE36886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 969KB
SHA256 b67e2b9fd689cb3d24cc396c9f2379b720724cbfdf318adb63c45b5a61f5cd1e
MD5 6907ecb734375f9a77c0f5239f37566b
SHA1 dfe8d5b5753d286f67c272d073951a0fdc21778d
SHA512 1b5d3b30f527b770607e8b92b9fa4fb9f9be02af9a1f6d66ab3153d1e16103ae079ddecaa969c39a126e5783bf947447f3be42c2ae81f7c853525153cedc0af1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Tiajp:A3mnXoZjzyaEFoHaewsAjYaEg6Tiajp
TLSH
T17C25B023EBB090B5D27B49705BA58713EB787C210B6056CBE36886591F317C07F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 969KB
SHA256 abc4d0972c297996b1e8ab749881245fc45f274eb165ba3332d6caeac5978b2e
MD5 154f0bc4ac39d218fe57c738c150e7be
SHA1 9fad965b88ee5b662b07e82a899cca67899c6c85
SHA512 bd44e3a1855bbab9ca124d2881d04b09b16bbbc937ebfd0742dd92bf15040ac7aa1fc44b369e44e181d44f343f4c460ca5fc33c8127ba99fbe61b72836d1ff13
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiaE0a:A3mnXoZjzyaEFoHaewsAjYaEg6TiaEN
TLSH
T16525B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 969KB
SHA256 1bea36e8e22dd30cfe2e2b8d9f250077910c5a8c17143589f932e40abdf47159
MD5 d37bd376eb5c610bb2919b776af12786
SHA1 2f3073d0d6749ebb56eacb7e19b3928830f96b1c
SHA512 a30026146e9fc963363d4e40fca3bf4ab28db9cf3b4e576adf10ceed0847c2baa04d7c24fc88ac2ff690837bad039017244d13a5e5f3ae4e47cbf99631cb09f3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiasF:A3mnXoZjzyaEFoHaewsAjYaEg6TiasF
TLSH
T18E25B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 969KB
SHA256 c5033ac2687d47b058f878ed467a53981e29493ab922e8e2799d86a69d7917f9
MD5 0d1715cc8215736626f23edc2877c55c
SHA1 963c609ad6885322d263e1b15f671a7b728c05a9
SHA512 ca9bf6d7c8c4dac44c083bc6ee285528d54f848a1a7023862fd2bf17a096ce6f6c9282a37608765d711e886f370147e5ce3eb533393d0250276d3f5bc9d4dd67
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiaZC:A3mnXoZjzyaEFoHaewsAjYaEg6TiaZC
TLSH
T1C425B023EBB090B5D23B49705BA58713EB787D210B6056CBE36886591F317C07F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 969KB
SHA256 51175e081863f9a15d8e775c21ea27c46c581fa3bbc49d3cb9338a0e4624cc49
MD5 e3f57bd3a7ca6aec1298db159ea25bd9
SHA1 19743bc392b60f23114318d8eac110094c0c9499
SHA512 a1955188f95273e54a19e11bf816269a19b678bdde2bbe7e0a1eead73870e5f9de7bc5d115a74e2476d3abab1b2d0996b0a20cdbe2a831b9a6e4584de6e32d6a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Tiaaw:A3mnXoZjzyaEFoHaewsAjYaEg6Tiaaw
TLSH
T19825B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 969KB
SHA256 902465a45ed7ddd13b97c968bbf9a17a0e4e3c46717d8739b9a25d4d5cc69309
MD5 1111c1255bf501be1edb14be73411291
SHA1 2c6be8533c2ee0e4b38dc87af36b03817b08a288
SHA512 0676a6b7f6a4e953cef3f0f34ffda4f6e94b212c595ed386ed5230293e7aa3b583b59af550c4c7a19cea4994bcbcebe59cd45d644cc956ba2b15f8698f7c1961
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiahT:A3mnXoZjzyaEFoHaewsAjYaEg6TiahT
TLSH
T14A25B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C07F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 969KB
SHA256 bdd86bb854c8e866bc3f33db38ede1d83e5ccbcb4402cc4f829ac7ebf73af634
MD5 cb3de0416650be38ec960d49f9c8e69b
SHA1 64ca5f57fb7066a41fcd0188dbd72c06098d2549
SHA512 db386f27d731dcc1747ee90f39d92227b6fe1c45b2780dfeba29bd243dc82f951b310faa508d36d46479bd4027bec6e13674eaad3aa27f176489f5780d899ace
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiaPu:A3mnXoZjzyaEFoHaewsAjYaEg6TiaPu
TLSH
T18E25B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C07F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 969KB
SHA256 956a0eef0d66c1610eef16fe0ee15c0e33d2ed9066826ad8fd88a07fd197a4a2
MD5 ba137533ec0e05d642bb5ca3d7551884
SHA1 49c4ce1711707ad9f4147ae0b585c1ef6a9532d4
SHA512 d2da34062322afdb86129749744a720b1e1365727592ff7fd0ea6a056d5166a8c74f9d7b4e45fb2481d98c9aac799c37437da5d5f0876e3e72d857230df1142b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Tiazb:A3mnXoZjzyaEFoHaewsAjYaEg6Tiazb
TLSH
T14325B023EBB090B5D27B49705BB58713EB397C210B6056CBE36886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 969KB
SHA256 69536ea359d1bc5fd934af4d3627f871ace16da703189e23116364f0b71d6efb
MD5 2e4359f9774bceccb022aa2283ab0cc9
SHA1 4e2513c35cb6959ae6abaac07d48bb71040177d2
SHA512 0a4d53277b4b7a6692e7504d0b9949068012bfcc36bde1676f2387fd4be1274e16084b20313db8aab3d5440f94487e969a5f5e09dcfda4f57f061e5037bedb31
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiaHf:A3mnXoZjzyaEFoHaewsAjYaEg6TiaHf
TLSH
T18125B023EBB090B5D23B49705BA58713EB397D210B6056CBE36886591F317C07F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 969KB
SHA256 fbddea23c25d013755b2c3f76a762d15a496090b66fd7add8a4d96facd2b8009
MD5 01db6dd8c02ce3e1b6350c22a1f3cc36
SHA1 c156c280d8145e556970a7ff7889a9a5c26ccac4
SHA512 5843851c5997a9a0cf49ccb997c83fce86383aa3e700b429331df11029a02a4f6bd37fbffe96e179a003ddd110fbfae9041831a322afd05342047e13d926ead7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiawK:A3mnXoZjzyaEFoHaewsAjYaEg6TiawK
TLSH
T1F725B023EBB090B5D27B49705BA58713EB787C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 969KB
SHA256 5ea866466856dedc70924b6fadaa984dd48881dd0da974d4b9fdc13943e5ec29
MD5 67a9eb527fa9642a8d48f8b35f1f9388
SHA1 e4f36a4172e5e6ead8d0c71ddcc42a9d5eae6dee
SHA512 b664d42d09600ce4073173abf1da44b1753c3e63a80ae846e320b507c12c768c2008d946a9e9ef0852ba949a819f5ce5dba02e9588cb3e00e9c9e2bb9a445417
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Tiatk:A3mnXoZjzyaEFoHaewsAjYaEg6Tiatk
TLSH
T1D225B023EBB090B5D27B49705BA58713EB397C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 969KB
SHA256 1f8c67194f9818863df7c71488173403711057cc74937fb79ba1809c438a144f
MD5 74dbcdfd4675cd8a5037108e9d97efbc
SHA1 7b7947b4c03f97de212a2faa6bfcc54ea16d6942
SHA512 9a7b75c5c5394dde7ce7a27ace8e32b20e913129f8e265f2c4f6a0ff6c75315f1c1f2f7ff1ee8fcc9c3d03cc4651dc524920e3ad86338d24cf94cfedcb28e0db
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Tiay0:A3mnXoZjzyaEFoHaewsAjYaEg6Tiay0
TLSH
T1B525B023EBB090B5D23B49705BA58713EB397D210B6056CBE36886591F317C07F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 969KB
SHA256 fda85bb8efe542502e33f1a8faa90a7e0b60b5acd020ab616ac2481799a176c3
MD5 26526a0a87506446f66ae38fcadfc578
SHA1 655501da81fecaf2599c84e5e058ac9e23389684
SHA512 c6fc423a98295d41e366206af6c14e04023a542d901ec553ba7b7602e57f696562ed5c3b2643bdf7d7c7045457d34488db6a8b4677eaf1c944dc86073da16f4d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiaB70:A3mnXoZjzyaEFoHaewsAjYaEg6TiaBg
TLSH
T11D25B023EBB090B5D27B49705BA58713EB397C210B6056CBE36886591F317C07F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 969KB
SHA256 c695c4671e5223140bb0ee391c8c45fb15870272152f2ec0dd13d224da09078d
MD5 cfae598018f0546dce2735a19bcff66f
SHA1 ad436401442cd084c63de3fc48019420fccf40c7
SHA512 cbffeae6be656282bc1311965cea4f2945c98b51944aba7f9a6e8a1294eca2c46d22343a6206770a8f53e8f0761f6e4b6a47d999c4bb1b238a7082a0fb918d62
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Tiaor:A3mnXoZjzyaEFoHaewsAjYaEg6Tiaor
TLSH
T11825B023EBB090B5D27B49705BB58713EB787C210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 969KB
SHA256 95cccde6c12378f2bf9623ebdf6f3bddb01c4b0f139675491fb09b31c797fa89
MD5 69b72e461f07a4531e73235513d43180
SHA1 f779663e3b83a52d07aa7bd0f01c1301a6fd66d2
SHA512 1ed0e1df75eb8bc65ae1168eaeb4a1369adb77a9506842ef6fa888dff2255f4a5203e4b0d7ec48b46ad52f680d5ad5b25ba2ad22acf25484808e2bc39bbf12ed
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiaGn:A3mnXoZjzyaEFoHaewsAjYaEg6TiaGn
TLSH
T10C25B023EBB090B5D27B49705BB58713EB397C210B6056CBE36886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 969KB
SHA256 1f6efc5d6e244a46156ec26978132cd8ce9ad98ea63ff66a0160ae538a7c737c
MD5 ae5c93dda81060c1e3a4fabe9bdb995c
SHA1 65327c2f45e12cea73356a64f06d225f9f30c816
SHA512 49ed444b8a6fb431453349bad334cc1534d1f9deed32f7981996e024122471e2c5b2eb9365d934e7a430528af0b02d145509159e6906b371540adf7dce930258
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiaMx:A3mnXoZjzyaEFoHaewsAjYaEg6TiaMx
TLSH
T14B25B023EBB090B5D27B49705BA58713EB397C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 969KB
SHA256 da5abfa75db10baf7fde079b19902f409e1f5a154c9f6a8c2ebe1e0cbc707b41
MD5 b6d79c6bd547acdb04366f7fe98b4889
SHA1 4b2918bf6d64908ea3aef5301fa69110801ebaac
SHA512 c52ff44796ab780af0ccf30fe8440eab0871276d17673782ef34adcf13572bd9654b55d9a3c8358b53b98619679dc13169e7600c1893f256e870f8c303f25cc9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiaGA:A3mnXoZjzyaEFoHaewsAjYaEg6TiaGA
TLSH
T10425B023EBB090B5D23B49705BB58713EB797C210B6056CBE36886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 969KB
SHA256 3d1d52238bd61f45fdaa7cdcadf07e6925fb2daa0856b3ced22ae9c476bca19f
MD5 937e9f0d0f179757f9d7198ce38ae5d4
SHA1 db829417459980d76984cc3e95180c3676ea5b0e
SHA512 185b293b7a25613f9806365662925d12102843299baaf41a3405aa855ec910563e7da5101910fa6fa58f31e33e5a6fafc365767eaa24890a316b4ed019016c2e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Tiaf9Q:A3mnXoZjzyaEFoHaewsAjYaEg6Tiaf9Q
TLSH
T1C925B023EBB090B5D23B49705BA58713EB787D210B6056CBE36886591F317C07F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 969KB
SHA256 1b16d562a8a576864393022931cbd2706b3894ef1c9e598ea07967d214d46b32
MD5 86fb605eb6fe7cc072dc8a438cf9dc6d
SHA1 c3f4d9e6cbf59f68a4dd3df5d084f2e86f23d3e8
SHA512 dea1332c448e079cfb8f07961ad255ed48545f480d7423750b855dc89e471066a08e33af742a9547704f74e8467610621b51096e7fe434197f7948fe0c2676b2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiaW4:A3mnXoZjzyaEFoHaewsAjYaEg6TiaW4
TLSH
T13B25B023EBB090B5D23B49705BA58713EB397D210B6056CBE36886591F317C07F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 969KB
SHA256 affd3940f3f75e03bf5e0ef9f39bf39f86891a8537a1a3a79071f5e54aec014a
MD5 8f39896ef4a628ee7910581be58a0752
SHA1 d41e09722fecaac12bdcd611b4079d27c1dcd657
SHA512 64a1cfa8383febc7ad2b1169d35bb3d9502be41b2af923c9b86ef71f7a3e5445e76e55d585cbfa925a7a8ffeb80ae1ab03e9fba6d7cae39ebb697787c3d7905e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiaFu:A3mnXoZjzyaEFoHaewsAjYaEg6TiaFu
TLSH
T17A25B023EBB090B5D27B49705BA58713EB397C210B6056CBE36886591F317C07F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 969KB
SHA256 4bedf284a773a16c0b9b452ffe4c08a82ab0ea46af3bfbea58faba64d479044a
MD5 88e2ddf7c5d1a405b897b68a427427c2
SHA1 629c1f5fd02a4cb36d8f878495a9478ef60727b5
SHA512 90e19811f6bc305380943f040640fe888951c2f99c1267b3f7f0eb044220e686fdaba5eb25a7d985db6659ae28e37f9a052ea97bd140cba6a3af4972840b8db1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiaYj:A3mnXoZjzyaEFoHaewsAjYaEg6TiaYj
TLSH
T1D325B023EBB090B5D27B49705BA58713EB397C210B6056CBE36886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 969KB
SHA256 555f9d6f4f93250a3d34b60d9fe0531aa4ad2245c341f11bf05f20a3b7f1f39e
MD5 f64c6e980f33c68b339d648f3491963e
SHA1 c19daa8d46f5068a217e4e5693193558adc4a473
SHA512 2a6c89e1ab3060ba0ae7b4ea29d005f3c52bf217e01ff73d979324949fe30696f5d8b5b9c4a6a3cef9e8c2925c7bbfb088d378ec937dde46bc29114dc0a65e15
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Tiapg:A3mnXoZjzyaEFoHaewsAjYaEg6Tiapg
TLSH
T15F25B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 969KB
SHA256 8b3c01b6b6bdecd162073533af3cd0b2f1de7a8919ed3d201974f65b991f914f
MD5 9dc04b71ad2f0a03469355299dbfad0c
SHA1 3b50bdb790d6d8a60d824cfe8a16e6d798a6fe0d
SHA512 bd42a6625b2652edf610c487834797f0bdf038c84fa8b90b8f7d09b3ed7ba0d837728f5ae23ce184d95244e9c0dfc721d621b1b73aed0c2bb98fccb8a04726f3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiawI:A3mnXoZjzyaEFoHaewsAjYaEg6TiawI
TLSH
T16C25B023EBB090B5D27B49705BB58713EB397C210B6056CBE36886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 969KB
SHA256 742a444061138cff0352b20a3f099d5b1981465b0f96f80919f2c53f6a5b7c4e
MD5 e44edc14bf47ccd7a3551ab59d7a187f
SHA1 213d348360a5748413b5ea177f114ce3263bcf32
SHA512 34d8a1b2dd8310242e9bddaee2ea854bdeafe1560340768407ac81d49f38cc9dacd796c9a72f38b38337fb5edf8cce7b3b47524ebd917291cb552e65a6fcccaa
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Tiayo:A3mnXoZjzyaEFoHaewsAjYaEg6Tiayo
TLSH
T11625B023EBB090B5D23B49705BA58713EB397D210B6056CBE36886591F317C07F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 969KB
SHA256 d0d4d6099c159036d1d68c7a30a295d2f031dd0460ae15404cf91c8924099846
MD5 0ff3faa96bad15bdf31fba49a0c769ff
SHA1 56d7b7f3e0d4505589b7b8f01d7dc1009e8e3c6c
SHA512 95e796599c2264ab16cb620b70c93dea28908d95cf1c9d3ab06003c3767c120fd6151320ee5a070f21f84629f921f7daee525c58b47a8f4e5f1b46049ac6ff56
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Tiap+:A3mnXoZjzyaEFoHaewsAjYaEg6Tiap+
TLSH
T12C25B023EBB090B5D23B49705BB58713EB397C210B6056CBE36886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 969KB
SHA256 220777f51cdd066bd8d7e86d41c8eb2c18e029bda3b67f043460fa2b5a5a6265
MD5 02ca9bf36cfc235b57185d49cf3c0a9a
SHA1 541cfca75f0abc8c743397bb518e51e3b9e53630
SHA512 de79df1193720966a5bb6d504e716b50e43537e3955c853bcea848099955043ec7c408a2bdac840bf1352267f08b7ff90fba7eb5ef0fd74af8491a8040f5fdab
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiaXQ:A3mnXoZjzyaEFoHaewsAjYaEg6TiaXQ
TLSH
T10925B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 969KB
SHA256 aefdf3d33f31adc8773eea2146eecc9ab6f26dcf30c91074c84c3e301211f0c2
MD5 f6f4d26767b752d6975c48c808c6f531
SHA1 af35f01b0c80974bd44aab175d5cdd7e15bcfdd7
SHA512 d16aa198dd47b3df8b9ef6a505baf4e92ba0afb847c58d3d933199e2c6f7e65afbe26aed2ff46af9f0dc382e7a49024e59adff4566786ae810e7413b58f5d8a7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiasX:A3mnXoZjzyaEFoHaewsAjYaEg6TiasX
TLSH
T12025B023EBB090B5D23B49705BA58713EB787D210B6056CBE36886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 969KB
SHA256 46bb080540b1aef87eb4cf788b211335de583d3dfdcb59f1fcc9671695b91fe6
MD5 6a48084e9d30d0bb7a266df209b04887
SHA1 a25bc360e81e26828ec035e43ade1a2596b59bc1
SHA512 1f829a324de25c4d2db918695556abafcbfe60a6a7ea72c484d34ab9a57fdd06f0e1f57e9c9669b47db9172a0d370bbed1a9bc4f9b85a35494b120c5190aff12
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiaKL:A3mnXoZjzyaEFoHaewsAjYaEg6TiaKL
TLSH
T18425B023EBB090B5D27B49705BB58713EB397C210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 969KB
SHA256 3b6e266dee58443cccbbb55d65777826850c2f5150547b1b49e5777cb7ef8b25
MD5 fb661ae92b314306a084b9cf6259598e
SHA1 f7fe315c486351d71f12b60d845fbc4a49a139ca
SHA512 b0b93515356e4a55858722194bf62c055698e207caf1c15987f2c62b9823b5bc2d78db5157ba332176d8aaab54885daa51f4ccbf410283e774f3bdab71c9d119
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6TiauFC:A3mnXoZjzyaEFoHaewsAjYaEg6TiauM
TLSH
T1DC25B023EBB090B5D23B49705BA58713EB397D210B6056CBE36886591F317C07F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 969KB
SHA256 ec8c38b1f030df51ccd7a3da7ccea20b424ac09bb9a6f3383662b8df0a17ce6b
MD5 b48fbfe5511f266e480fbc149a6d3661
SHA1 ca4384ab7ce839840c6e42568c8a25fb1bd1e5ff
SHA512 4d15203be678cdc5220469a6133b418f6507caa2b4f899211504b043036fdfb3bef6fe63ee49658aeda799001184bd9fd011f1419de03461545c1d44e050f6c3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Tia3h:A3mnXoZjzyaEFoHaewsAjYaEg6Tia3h
TLSH
T1AA25B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2008-161-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2440-94-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2440-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads