1ddacdf82631367a7300e1764e2ca84020c8763221bba45294bf7f08a04c0410

Analysis

max time kernel
96s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Size 883KB
Sample260811-2e441atbla
SHA256 1ddacdf82631367a7300e1764e2ca84020c8763221bba45294bf7f08a04c0410
MD5 959e3940b96ed8b8a23848ed028bb561
SHA1 04625ffe6d95a42b59de88267f9e95dacaffec98
SHA512 330ee06be6ccb2ca6357b3e63ab37243d9fb27504f9e4493ba00f853e3b211fc1fddab43ddfd48b4659112516f9ec6ae35cc9c530d7bbf41ffa1f2095d3c9314
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohc:A3mnXoZjzyaT4aewsAjl5SaRaohc
TLSH
T15B15B023FB7090B5D27B49705B65C712E7397C210B605ACBE3A88A591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4424-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5ba-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e6-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4424-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4396-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a3e-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982b-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bb-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bc-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3b-568.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-611.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-636.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c2-721.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-1092.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1319.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-1332.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1352.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1399.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5ba-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e1-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e6-57.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a3e-234.dat	aspack_v212_v242
behavioral2/files/0x000400000001982b-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bb-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bc-489.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3b-568.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-611.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c1-636.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c2-721.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c3-741.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-1092.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1135.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1166.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1319.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-1332.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1352.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1399.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4396	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4424	2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
4396	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_959e3940b96ed8b8a23848ed028bb561_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4424

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 883KB
SHA256 1ddacdf82631367a7300e1764e2ca84020c8763221bba45294bf7f08a04c0410
MD5 959e3940b96ed8b8a23848ed028bb561
SHA1 04625ffe6d95a42b59de88267f9e95dacaffec98
SHA512 330ee06be6ccb2ca6357b3e63ab37243d9fb27504f9e4493ba00f853e3b211fc1fddab43ddfd48b4659112516f9ec6ae35cc9c530d7bbf41ffa1f2095d3c9314
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohc:A3mnXoZjzyaT4aewsAjl5SaRaohc
TLSH
T15B15B023FB7090B5D27B49705B65C712E7397C210B605ACBE3A88A591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 980827786fb1cdf4d12d1d520948b7939c171666af5a470d7a538b84bd332e4d
MD5 212c90842ff959ae67da0be623c68af9
SHA1 54a97d1ca7eb54de095a55cd1bea883126a01963
SHA512 37c56ad764474d4dac97121c7440fcf8abdd708a9ab4b472a8ef3a2d406d3f90be1b229a7a68a10eb7bba62fe343372fbbde4012b6a29f02be266f954f35f319
SSDEEP 24576:A3mnXoZjzyaT4aewsAjl5SaRaohk0Le5ji0hmxNrM:A3kMPljMPji0Aj
TLSH
T1EC658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 897KB
SHA256 fbc0519225c81bfd2e0a216870d20c3fa090fad6a68b25ae83a1da9a1297dd38
MD5 d21b1c72e12d5b362f3cf7b8fd638ca1
SHA1 6c6381301f0efc39b384496a3c6228615b65d756
SHA512 f0dd624390531ec1cfa9dceff9b7498b039b8e4768ec76c8b194e20499fa6f48e53ab51525a1dbe2ccd32c85de47e7feb5ad3fb8d43eda7ebac75867e7fdad73
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohOa:A3mnXoZjzyaT4aewsAjl5SaRaohOa
TLSH
T17E15B023FB7090B5D27B49705B658712E7397C210B605ACBE3A88A5D1F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 907KB
SHA256 7f47702be3b39a66b476fc247dfcd02a53efa1b11a1a713c8b292f694965e319
MD5 f6040b1443cb5b77df99ddbbc8efbdca
SHA1 fbf94a44a01b7f7491e03bfdc39e10f44cfdbad8
SHA512 2b853c52823fa74894a5fb9041b2729bb6c9850cb3ead2e5a2859cbcd34d7416e59b531f64140b92b73d37b0ce529f6a9cfdd38d45e12533f2a72afd4dbf5847
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohv6:A3mnXoZjzyaT4aewsAjl5SaRaohv6
TLSH
T13715B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 907KB
SHA256 7e774d2bf44dd59b941feceba53afcf64b85b46237091ecbb5b77726b66db60a
MD5 c2287dc483ca0e1f4021c58d1119e7b8
SHA1 ec9cfa0b134b18bea8f7d2e0c1ce4e0f7ff8682b
SHA512 87c29d8e83e17e78056189dc274872810488c49c5f0c3b775e86374cc884b1618fb641052a2f6dd6a607458aa93688903c71063b42d2d00205c149a66ee47f33
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohxN:A3mnXoZjzyaT4aewsAjl5SaRaohxN
TLSH
T18915B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 907KB
SHA256 018347a7907eeb77b169de20d1cd6322c17577fb7f93daea62917fdd755b1a5b
MD5 538c3d41662a74fa66625ff47a147aef
SHA1 2eece963617bc270d3e1f6b07d7cd8da6f43e671
SHA512 87e9e4c3036f357d6e69ef7c77106850cb1a157ef6183ba603049e29a8ce6301208547771b37068729d0a03d83a8ff32d93f4ab5b6b41ee85192aaa583992af0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohnf:A3mnXoZjzyaT4aewsAjl5SaRaohnf
TLSH
T1F115B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 907KB
SHA256 f14305a5a7901582e7833acf8ff13dd8d0fbfce6b017b1ba1553f2b6ae9a0ae4
MD5 5f2617afdb3c3f0dfd9967a14dafd4cd
SHA1 bde4e0f4b0ef5faf44f1cbef26e8575abb3042a3
SHA512 1832c33c372d08cc08caf6aae30505c440ab398d7667644432f98e4618eb077d2a0256e3d3828ec8a96c06cdf1972542ccceb7c0ea0b9ff51215315cb7197e67
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohpo:A3mnXoZjzyaT4aewsAjl5SaRaohpo
TLSH
T18415B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 907KB
SHA256 66615b9ca0a902f93e357dda23c0c0ce3828ce662d1c12063896f2e0a71902b9
MD5 60b8af401bd4642a13328ca8e11b3382
SHA1 dec9a5746da24c218ae23f62c7d15a38dd13d21f
SHA512 3bf8523fc7441e3bddd42370a4b29426968e65c5e1026a57ec0be5c1e4d8a86c17be0c0f23e2ac5076f9fa77caed367f564bc643f96a907b897c692215c18c66
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohZu:A3mnXoZjzyaT4aewsAjl5SaRaohZu
TLSH
T16815B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 907KB
SHA256 d6f2196a1346b65aae709b14d6901ff925b8e5c2cc7f1c139d401638cfcfd43e
MD5 dd50e240aef2acf197e36f1963f6a711
SHA1 ce9d4da1fbb550aa7a9d37ebb9c76ebf76789b3e
SHA512 43b33cd89898ee392af325f8e2a5762aef56a7b5bdfdf9492e832cf8840804b8f9ecb0281286f87a240cd6dee2753170b788894b5bb408c861e6ad226313e0d0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaoh/9:A3mnXoZjzyaT4aewsAjl5SaRaoh/9
TLSH
T19E15B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 907KB
SHA256 cbbc5d38a1480e0cc4ba3aec565349ca2804b646d15e11ecf048619725728627
MD5 2e9c0ae4e200dbb7b475b8f4fde91f1f
SHA1 9b25a2f5c653b72cf4fae3e9056ee945ea2adaa2
SHA512 ffda6f6434d38a9d674b8596d5f8f495b50d64714fd0b672aaaba88b11df07ddd28815ea44cb4741a80801e53c24ceb13dfd732d105214731e6943d4698d5aab
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohbc:A3mnXoZjzyaT4aewsAjl5SaRaohbc
TLSH
T1D115B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 907KB
SHA256 a8825c923ad0162174cc88e9ef414fc6e0a43f980ceaa4d2534d6eccae2160ac
MD5 dba0660afd80429e36124ddf95309c89
SHA1 bb8fa00d9026b165706d2083911250b467363999
SHA512 3258f49d8c3524b506ea59b8b9bf84d9f0dd9f9f71dd206e0ba32f556a885ea9f1bce1d4b9ef1d0cf022e7729056b34a9f40cb0d8e8aa8fc57b281071452487a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohEp:A3mnXoZjzyaT4aewsAjl5SaRaohEp
TLSH
T1DC15B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 907KB
SHA256 105b335aa52007294dc335da39073e8025140a119e8a0ea3058d766d878fb9d4
MD5 15363d5801dd75214cd337d7017e7250
SHA1 3d26c3ab504bd49ab1e04bb669583e6e01acf00f
SHA512 b76e46313ccce27c5d6ed43e6c95d6f7c3a0bb74e152db0e764eac07843f8ef7f6e0b64b9fe4d9dcb512bcd2e5656923605469316c3784aa6a008c3da4a7d15a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohL0a:A3mnXoZjzyaT4aewsAjl5SaRaohLN
TLSH
T17515B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 907KB
SHA256 cd59b92d334ea2d5dba04cdd1b8a8660f006d40b0744e79c3d8783416c750b53
MD5 d6ebac9f8072bc9f4808070ab0235279
SHA1 2bdcf4d7202d285d8774bcd084f617819e3f8fcf
SHA512 e0de23e146f9d19c1efb68718abb81969553453c142dcc45ece6087296e5b4c37e7c9693c3cd335289792a73ae13c4f55965056572f885c61b299c5e45309113
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohZF:A3mnXoZjzyaT4aewsAjl5SaRaohZF
TLSH
T1C415B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 907KB
SHA256 f8f105674b16a194f2e0de9134c5fd164bfee497d1baa90d69a5e5495c26a397
MD5 b756cb9c12e6481b6f1268abd27c9908
SHA1 7d81b6b3de6af67aed7629ba8a6d98bbe52d1456
SHA512 11df0f946d3a38f55a9b84e307925f8b5231aaea6ee033a7e0321f98aec21f45fc5b88fa1a8991e5dfb198d11b70b55a197310f9243a651b7c8d6cff14223c7b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohyC:A3mnXoZjzyaT4aewsAjl5SaRaohyC
TLSH
T1B615B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 907KB
SHA256 0c32d491d562f5be6076df7b012eb733cb565076559f6a955607f0c2c23e1e5a
MD5 9c96c46c26690560e430f6e747c21017
SHA1 ecac4947b6314fb0296c8bcd27d94772327fc9d7
SHA512 0d744815a70e298b4962af186064ba55e681de14f891a57863470dea3179b74269ea79111db1e5ccc40c92d0dcc36522fdf91474ec1775038a4c56fe69e45495
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohtw:A3mnXoZjzyaT4aewsAjl5SaRaohtw
TLSH
T1F315B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 907KB
SHA256 8da030dada8ccc74f7e8a9cadea3b1d9435897b17b5cfae9b1040c86c5ba02b2
MD5 09ad953f24f4fae3bf514c70c60a46c7
SHA1 8ca40e622a97e101b8c33b52938eb0d263624da1
SHA512 6ce9dcd3da63e048ac0c717a217b496eadf79699938b2650922ea1c173aec6b7fab6f47b5c7d56475fdd3aeb9a0721ddba55f9a5d61ddf7b585eb08d3eb7c1b2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohcT:A3mnXoZjzyaT4aewsAjl5SaRaohcT
TLSH
T11E15B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 907KB
SHA256 3f69d249715010455a630212a1fc323f0c86ea23a9c5c4062e6874d13cf26bdc
MD5 0256327e83efcc2e285e611a516a61e6
SHA1 cf66328af39a6faf1ab946ee182ed6ad1fcba570
SHA512 490e7db725b66421eb3c48be55e15f6869c02fe946891677afa1fb4c0f6e90abe817b4abeed1c18c980f12da499e9ae0ea878aab05fef1a199f9cfae33aacc58
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohwu:A3mnXoZjzyaT4aewsAjl5SaRaohwu
TLSH
T12715B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 907KB
SHA256 a572db0b0eddd10a6e053c7911f9f059009bb46cfef2f38823f22665cb07fc25
MD5 9aa161b4e483010df48d11789835fbe5
SHA1 43aea68e3987691ea73e96408a03317bfdfeac37
SHA512 f891274bb196c300ddefa6883b5d68bb9489ffb5a1f083da62c5dcdf57e518813c743dd8351d309f2725b6774364589dd6382430d6aaf06c30f403528481a806
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohOb:A3mnXoZjzyaT4aewsAjl5SaRaohOb
TLSH
T15915B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 907KB
SHA256 229c77a812ce48257a15e0bdedc65625ef31dc5d60b3ade5ca1e83aa04da5c7b
MD5 c228733f81f76f2600817d1c992f0247
SHA1 85437fa824b211588e7e8ca0d2cc564702bb5d6e
SHA512 7aabe5d712eccf7102b256e349796309ef34536c62be4f66ffe95e560cb9884f3f708e07902acc1d737b71f6d561a2272fff27a05595e582738c264381e29f0d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaoh4f:A3mnXoZjzyaT4aewsAjl5SaRaoh4f
TLSH
T1A415B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 907KB
SHA256 ea0203231b358319a91ef78fda87221c973c480801e427a3deabc633906d66fe
MD5 5ddedd5f2a52251f2c8c750cccb991b9
SHA1 dcd4c0eeeda040bec0e8a44fec6dae3f5aef473d
SHA512 8df595a8adf4cf54ce47a8189a4d87bfae76363c39e540a42277d9eda2ab6d89e3b8635868fc6e90a9be09dd40842b85b9946340fae8d619245ac85829085f97
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaoh1K:A3mnXoZjzyaT4aewsAjl5SaRaoh1K
TLSH
T12715B023FB7090B5D27B49705BA5C712EB787C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 907KB
SHA256 3876b63499de2143ddf2fbb92c1cac29621ec7c1b9528c4f79fa7c1486900129
MD5 b84027bdc939ebf3c8c464a63f115648
SHA1 19870da4729d823f08d69277cec1476720fde2fe
SHA512 c255eb9341db85b27ac5094686f3a80c3875a05fe8189b16b3ce4573fdec00156e9b976a814b28ed400e65cebb86aa6b10aa4c0303d9c6f653e025d0d7fe03e0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaoh2k:A3mnXoZjzyaT4aewsAjl5SaRaoh2k
TLSH
T16315B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 907KB
SHA256 93f95005d0895e5e4ffb435c7d659587b8e0b1eea06f2e15abce8524afbb2f5f
MD5 62f3ea56fbf1c99cefd0ced66827400f
SHA1 c318dc91f22480330dfb59edd4fd7a0cc4d66422
SHA512 f3337aa406b2a826fd3dff1733f80070f0222738d961ebc2d854218a2a2cdda57c4e4e14f82a53e445c6ae0e358b35fb94b7452e85fb09b38450a7e0a0b823a7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohT0:A3mnXoZjzyaT4aewsAjl5SaRaohT0
TLSH
T19A15B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 907KB
SHA256 a32fe1bc0cf5d88efb0286a4f9ea994e41fff59d53e27faedc164bf35a3e23cc
MD5 4c1cc3b83a2ae9ef4d11c424f4e55656
SHA1 dde046e9b4d066bd82cd5c96865b3442e8151fb5
SHA512 b392e79e520a564113167cf3d087f85c3e6f44bd05da529a2c3a92ab7d5cd748ec6c40bd20c80635a70a65898691742411ce52152a37058062fac891f42e1117
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohi70:A3mnXoZjzyaT4aewsAjl5SaRaohig
TLSH
T1C715B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 907KB
SHA256 d36c388b312dff0e8d06a8279965869985067fca975244b25296080db016aab4
MD5 835469967cda766a4e75f9ff67b7d691
SHA1 e46d6b13df77e46ab9bf64b48dd090eefd71d6cc
SHA512 3cfb43b4bab428041a45c17d6c07e88dc70411ea12e1465f41ce7382a49b21309a41ec394270399e6741a0631e22e9059c56ae26fb22c0d88633ef7ade10d1ae
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohDr:A3mnXoZjzyaT4aewsAjl5SaRaohDr
TLSH
T11615B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 907KB
SHA256 83437c4eccd6c43c296faba45f0c31ea118e58fdbc266723d873df519571e639
MD5 49bdd6dc5e47f97ebab3aabd73ef734d
SHA1 4900c431184f2ac146578b94dc8183fad7d01c1d
SHA512 c547507a183faad27ad9381042837699a5c64e6243f69b0c54b712dc67eddeddd3b4911571fa0c154095f16065c5eb079a6c30fb78c9575f89c4061a79a6fd09
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohln:A3mnXoZjzyaT4aewsAjl5SaRaohln
TLSH
T18415B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 907KB
SHA256 1272c079ce999f8fd2a5fb6f1aa7a55ec90e07345958a945a2dcf6fa9f30948c
MD5 cda53b17e37c20babe49a890a0074374
SHA1 5df2ae3582579ec2395fac22a3a450897b45c27e
SHA512 33ec11e54ea2b578b3b888e59ce8d715cd1f7b8af278c265b69c1fce3df499348d5e4f58bdb6689daaefcce4aa66cf57a9d589d5877bd5475502d3d41dbcbb8d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohRx:A3mnXoZjzyaT4aewsAjl5SaRaohRx
TLSH
T12F15B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 907KB
SHA256 25ac024482929cc146734dd77e7c20c694ddf616ba071b2b6f409ae9744a2e63
MD5 8e56937c3e901be30d9b98ef48ce18b8
SHA1 c693f68e769bb047a6923d80ee5b61ea4c8b6e0c
SHA512 33103753005069a8f72ea92d9ae8184299f6862bfbd06363ac34333f34ed738b2ddc903a8fc176e22f25b033c9441921f1f37c741b76d88eaa1a69069334f5da
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaoh/A:A3mnXoZjzyaT4aewsAjl5SaRaoh/A
TLSH
T11915B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 907KB
SHA256 dbfbd1cce96902abc0d171523fe2a684fa425ab3469d1a7d52b92638ed365d1c
MD5 b9e65bf4611f92c433039b80fe2606eb
SHA1 611f52c7d3c4070ba42f21e0c0734875692e0e70
SHA512 639d80bbc4e45649e02efe969329cf8b66717ffbd968336853c93b63a723bd48dbceae1760afb07ebe5af6c57d3181dd5d31cf4daa043da6a46d4c0ae6fa8b90
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohQ9Q:A3mnXoZjzyaT4aewsAjl5SaRaohQ9Q
TLSH
T19215B023FB7090B5D23B49715BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 907KB
SHA256 d2455d382d220b565128e9150a694bb899edc20b43f33e6eacd9baa867d6eb2d
MD5 40cfee882f8e54bdfa007720003852ed
SHA1 7e35f3f3e7ea4d00e27742430788d12e6a92fb95
SHA512 68d7cd330cba297dac7fbbb4029875b7a100640cd4576da7d8771cbf7b03da7c4cc61efde42f2dfa57868cc59e8b85a04b9bd6cbd71789ccdbe26c0808c5f7fa
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohx4:A3mnXoZjzyaT4aewsAjl5SaRaohx4
TLSH
T1E915B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 907KB
SHA256 2601b69e4123ddb1c9951bb3f2b2f26dc557195dcbf9e89a72175a9a7331b8f4
MD5 55dc88a1ce5dda4666ddc87560932e90
SHA1 a15ffaa27171918dbfa87ec4fbc7e451b10124a7
SHA512 dd29224b24c729a66c3839b3f227b4524aea529b33e226b0c58cd2394acab8e5ce21cd4dfda1ae74fa85c19cd7d5ebfaa87733352152a8a75af8955a4b2d66e5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaoh0u:A3mnXoZjzyaT4aewsAjl5SaRaoh0u
TLSH
T19B15B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 907KB
SHA256 e58cb7f8466d6e13c5d140d527d4825cdbbac882c5e607414e3dc6497746e197
MD5 ba89f4e5b54035590dde581d092afd8f
SHA1 f953c4a9eaadbbf303a18f0bf2546e4a4f999f49
SHA512 ada5f7ae9b1c67fae0c862843b63cff701c02378b016b82b005e7890871927a1f3577f6730bd0eee57450efdf9a776c317b329f76974220e0d48845da61cf140
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohFj:A3mnXoZjzyaT4aewsAjl5SaRaohFj
TLSH
T15315B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 907KB
SHA256 ddba5be66cabeee154b3559811cc7c603ae268dbf89ed92c650519c34b122dca
MD5 82556ab6efb6fa1d384c3b5754c30c5f
SHA1 0494fe345d1be3354e410063b2e2068f008baa79
SHA512 28bd376bfdb08798a371add47b6a4fe8409b476bf9b9400f8ca98ea46535497c6b433d06253051a13c47cfc2f90f6f1f64632226e73123f78043cb7b80b74b73
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohMg:A3mnXoZjzyaT4aewsAjl5SaRaohMg
TLSH
T1EF15B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 907KB
SHA256 843c91adc0c2f0154649e761c30acf348f1bd42cd481d4eab3105d63a29ae08d
MD5 6b7bf71c3ed41ee06696921b48f7c4a7
SHA1 9435827ce3ba6f79a6aa7912b22912e406455001
SHA512 279957722d717ed0c696ef3e9db15f6826c231ececddee33530da584f8515679c7209dc4a023b04279d9b1df509df765cfb951a33cd237d5d1b604c1137649fb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohTI:A3mnXoZjzyaT4aewsAjl5SaRaohTI
TLSH
T10715B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 907KB
SHA256 040a72924b796ca6e6d2681be7e623a1352e1719a43852e18d449920f3fa36ba
MD5 432ec04cfdc3e58a193d71851406c336
SHA1 b7e182b830aeda77b0144d1f8d1b404843414a16
SHA512 28f2957546c62ca7f64f3ae0619c52d775b85fce841d1e2d2d5f87620adf4764162e5ed55e20fb1e4420f9d1d11b2e8249826ca083642fe007abb0ffc3372ee3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohpo:A3mnXoZjzyaT4aewsAjl5SaRaohpo
TLSH
T13415B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 907KB
SHA256 27ca55724cd6214dbd7bb0c8d319a17ccfce682d55dccc2711da1ac53b49f1e8
MD5 437a2a6d4633ff3bf930d9fb9c770d5c
SHA1 eb7bcbba35e3f94ac4f82822abb2c5eeb22dbebf
SHA512 089e2636c525430c361f55ec7f6e3fc2d370fe9eb1e40ccf22ef00c7e01c9a94c7eb9827785add8505544e8973548057fb9b99b959df51db267e864980bc987a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaoha+:A3mnXoZjzyaT4aewsAjl5SaRaoha+
TLSH
T12D15B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 907KB
SHA256 f0335d46a0233d2e8f04237d0300b3ac637d855ab5325acd02d77e85588a3d02
MD5 e928b8b0ce2483ba2a2d44803ecd6686
SHA1 2d0d1724dd6611a275b45b0b35e615862cdbc81b
SHA512 7c10906da481ecb42e486ae4b6ea0da24a4eefcd841f51174a681f7ad202be9af70c861d814de4ac356348ac4c3a34500bc3e715c658b5539be56318612eaefc
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohaQ:A3mnXoZjzyaT4aewsAjl5SaRaohaQ
TLSH
T16915B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 907KB
SHA256 f81ac6782aef01e39fe72da3a20e8624f78006a911312a47fe83b18ea811b3f1
MD5 958406a82f2fae9c5fee9e8994992acd
SHA1 7768748edffb6729d68cc84e8f50834d4ff80577
SHA512 ad7e1eb071dba9c63e7f4fcf127ae912356962c691326aba2390f83216928e09057029d7470602e4a9ec9e9b3ea73095f8a4d1705aa4b4cc52d7534d5cdb2441
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohrX:A3mnXoZjzyaT4aewsAjl5SaRaohrX
TLSH
T1D215B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 907KB
SHA256 049afdca8ce225d3159e088f13af053810141076209cc7aa0b3361d6e3277e74
MD5 5736e8060c9f74d043128c2594ef3707
SHA1 c10b43c2ecc12f9d8b7dbd3277fd2813c4eef92d
SHA512 c6205242d9ea35f466218416fc59db1b797ae0598038b35417a36c0d9ff02ead9f34d038a9303c859bf165e9be6fb237bebcb61d2c10e71449a17b9e78a9a4f7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaoh5L:A3mnXoZjzyaT4aewsAjl5SaRaoh5L
TLSH
T18615B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 907KB
SHA256 bd3613edcadb418c1fecd994aad058f279cf014b86e219785d3b13a5b9c4973b
MD5 90ca6e31d2a953e0c0bf271784452de9
SHA1 47dbd21f52438b511c5b4fd886ada789dbf170bb
SHA512 710f80f7e84acc33e4fbf130f3cfde21e0b9d0f7e193c88ced2ff228536c2d48eb2c89cf91455cd95bd3b5b3b4451403e3741ee22efb942e371af04b2cf88bd0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohnFC:A3mnXoZjzyaT4aewsAjl5SaRaohnM
TLSH
T1C615B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 907KB
SHA256 1d6d61191e7a0dabfae12a4727dabe48ad9f6e784151a056a54149ea347651f5
MD5 0074b517b3555f3f1891289349dc0716
SHA1 6096a1219138632302794ad1237d960587c6d940
SHA512 beb508f2e21b7cd57c07ee1a9470d1d91243173a368d879944af8ce77e53ead06457ff913258de6e1f033d48f46fe40b1186b276ae99aed74036b929a08bc870
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaohQh:A3mnXoZjzyaT4aewsAjl5SaRaohQh
TLSH
T17E15B023FB7090B5D27B49705BA5C712EB397C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4396-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4424-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4424-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads