e7fd0ca291b9e8f6861ce4c4b18387d2f7114572bdbc0d3df3788ae2cd8f7771

Analysis

max time kernel
117s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 904KB
Sample260628-w2xesabz5n
SHA256 e7fd0ca291b9e8f6861ce4c4b18387d2f7114572bdbc0d3df3788ae2cd8f7771
MD5 e2ec0338a986a45dfda6414ecc144ac5
SHA1 a49a0313225174f06d111b12dd18f54cc8bdc2a4
SHA512 e5222ce29de6e86c601118cfd6022aaac1a3eec11ee4d00f5d509b139f86ba6397d53d14ca93c7d7eacdbece2cb2c3d1eb65452ccd842de7bad9e9d44d177370
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6ac:A3k03kHRJi56rj
TLSH
T190155A07A6890FA8C11FC1788A968662E7737C161F2097DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/1524-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c585-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1524-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4780-34-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2fb-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c84-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a28-210.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a2f-211.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a5a-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-231.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-244.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-251.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a57-264.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-303.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-316.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-335.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-486.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-511.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-602.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-639.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-719.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-750.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-800.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-837.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-868.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-900.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-945.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-964.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1020.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1064.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1101.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1150.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1188.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1195.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1334.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1407.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1408.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 43 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c585-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d1-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2fb-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c84-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a28-210.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a2f-211.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a5a-224.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-231.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-244.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-251.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a57-264.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-303.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-316.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-335.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-486.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-511.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-602.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-639.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-719.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-750.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-800.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-837.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-868.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-887.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-900.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-907.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-932.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-945.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-964.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1020.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1064.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1101.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1150.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1188.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1195.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1334.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1341.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1366.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1386.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1407.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1408.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4780	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1524	2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
4780	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_e2ec0338a986a45dfda6414ecc144ac5_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1524

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 904KB
SHA256 e7fd0ca291b9e8f6861ce4c4b18387d2f7114572bdbc0d3df3788ae2cd8f7771
MD5 e2ec0338a986a45dfda6414ecc144ac5
SHA1 a49a0313225174f06d111b12dd18f54cc8bdc2a4
SHA512 e5222ce29de6e86c601118cfd6022aaac1a3eec11ee4d00f5d509b139f86ba6397d53d14ca93c7d7eacdbece2cb2c3d1eb65452ccd842de7bad9e9d44d177370
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6ac:A3k03kHRJi56rj
TLSH
T190155A07A6890FA8C11FC1788A968662E7737C161F2097DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 77fecb007d7a7c109aeec1e80f27ac71bcab7fcc672c7336a2fa8b78e9202d16
MD5 ed776574daa44d07f5542d40ac04e94f
SHA1 3fd6cde656b87302294222e877d777ff13fe6609
SHA512 d2e5569c95ba063339d28c2c160d0a77223337d6c6a567bb476cd0bb724d5e612a3c29959f2c3a9ab1e95e6ed32dbc1693ad45becd9566efea2929a46a61f6ba
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6ak0Le5ji0hmxNrM:A3k03kHRJi56rfPji0Aj
TLSH
T101655B16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE293F67BD19A3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 919KB
SHA256 e28853766b8e4ca673539e95ff7b40e4be6b63ba44a8de8bff6fbf64e01d49b0
MD5 6349583ec565e87a7c04d99470e371fd
SHA1 b1d854d3546b7425b0e581089be6591ab2794a3f
SHA512 da82c8eb70ea6d0076dc0e42820e0fe46f510c3287d083c4fc8ba7f721bbbb526051100deaaefc8bf8739372ec9666dab489164113593ec2cc3a4b13b2aea735
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6aOa:A3k03kHRJi56r
TLSH
T113155A07A6890FA8D11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 952KB
SHA256 186fcfd10e9bf6a9eefa8dc284851a91c467090e32d33b1febb62400e8c04f64
MD5 ccee933e19ef6174a97e01240c548030
SHA1 f14377b7b0b7741389a263c6101b04029c7e5fb1
SHA512 074bc68285018ebf76572eaec95e68e8b830d864a2082988b0716b894da8715d4097c7b5f01caa40dad1a4c223f51ac20c848ac18f880836965e5ac40a98dffb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6aNb:A3k03kHRJi56rCb
TLSH
T158256A03A6980FA8D11FC1749A968622E7777C521F2093DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 928KB
SHA256 b4a110912cf1139b5a3d245e2821b069bc8ab57f73bb0b43120f92b8ecd1fd87
MD5 46c17c7433f9b74127ebd6d76bcbe649
SHA1 90d7218588241a5c3ab3da19dc558df7384b835e
SHA512 f5620dc598f509837bd28a08c80f6a48590dc5229b9f6107099cd197a4d9b6f87b58d97fa361516193fe54b1c4518ac27656d46ed36cd98090caead40548f8f8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6aQZ:A3k03kHRJi56rT
TLSH
T141155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 928KB
SHA256 5825a67ee9907090a5d9be6d1981021a0c8918ce017a64efb065c5aa5728ddeb
MD5 b319a6a694c2876cbe007cc598a94556
SHA1 3ec4f3e12a0885b11dd3efbac6153f7d3ae0a432
SHA512 09445471b1c6c916c2746f15339d32a91b1a7fc67a2a5f8577bb79acbfe536fd7249ea9ee4c2aab017bc22ea80e77e5eaa940962f561a08dc3fba6483525570f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6a31:A3k03kHRJi56r8
TLSH
T182155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 928KB
SHA256 bd242a64e37752903e343070bee7a2578249f1bf607f96ddea30ad08eac3eda5
MD5 f9cb4ffbb539e7f195815216f041d498
SHA1 1e4a3e4a9da0d1f289b8388e1b762328c97d9147
SHA512 2a6715299684063b3ca4a97931ea82cee910a0d122aa6d95f630e440e22702f1b5134e1675e0270323b64787cbd855820fc15d5a556f13c05c35dbf42324bd0e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6av6:A3k03kHRJi56rn
TLSH
T1F4155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 928KB
SHA256 912d101f49ed34bd7e4d22cc216e78303aa622595297a8696ac2e70201b95cff
MD5 380c25340f3270f35f23d01642f98555
SHA1 ea087b2aa8d0e9ad22c04384442c3ac52ece5ab7
SHA512 a48dc81354981dcd8d42204f402d2592b78b62a5e12d9f3fd75452a2e25eaf9c6026ea0ce499ff7769f1ff21e49151499b41215ae8688b3b9e8d24cfc2e31b9c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6axN:A3k03kHRJi56r6
TLSH
T11F155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 928KB
SHA256 8b2fd72f4d479678241e085e7656979a36e56e1ee39e18b4a22f7cff8da23dde
MD5 f271895a300e4e8b644862d5701c18b0
SHA1 921294232578520c1de16ad66daa084fcedc1e9f
SHA512 2e079eda459888732e0c894e2d62bd17935014fa8884f4697dda1abd73382e55c07033dfa4e4497a25c9c37d7bb391d82ab659dc067b0ce296a95a06c1905a18
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6anf:A3k03kHRJi56r2
TLSH
T1D4155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 928KB
SHA256 10f9607698670db39c7a2060229f6f91c53ecffdbfecdfd358070da95c4f450d
MD5 aa3b7ed79c742344cdf3787d5a2d001b
SHA1 4eaf5dabb0fad2a1ef50593f02dd045a458bcf90
SHA512 912e559414a56847b108150296b261458535a341d2ea5583830944cdb83525a733199e2765b453513555450b5f47d07a3d04fdf0a692e890a98673f4fb2fc662
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6apo:A3k03kHRJi56rX
TLSH
T183155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 928KB
SHA256 2a22e5ef21d0e0c549dbea689bfb9248376ea9cea797fcf44ccd4fd5de2f8011
MD5 f01c7f0d4a472b22be47a3bad8e97c2a
SHA1 577a1c158302e03c49ce6ab96646718402ac4a77
SHA512 1c568a58eb97e8495c005bdd8d1db8b448f9c96e0179ac2622d4aea59aa0b72bebc7927d7d30f3eaae7f4bf99aa269d6897aa8dfaa7a4462e5bf517a6148cf66
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6aZu:A3k03kHRJi56rZ
TLSH
T125155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 928KB
SHA256 e126e00b23c4415ca6104f6e084a877fa58a9dd3c39fb751ec8ee19a1c9d97e5
MD5 2f98eae236fbee53a472b2ae088e316b
SHA1 5942c21266a98fea95908a6c41187718f602ee23
SHA512 88763c679aa1c52d551779a902a85c2d49a234b287b044178c711e7c01cd4b4341e25e1b81391e7b35164f431f8b67ead50bad8fa4010f807d035d7a06559601
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6a/9:A3k03kHRJi56rU
TLSH
T148155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 928KB
SHA256 5e58b0734fd8a03f2d1dd43d9160cab254df2aa194e0e722a3088bb424787503
MD5 49eb3809867371c61eca834b8e08fc7a
SHA1 9375086d38c6999d52b988a05badb9636532338a
SHA512 89086816a964c07fa0b67c66822db0e6663f2a9c005745bce8e65eba5091d42c2c02349cf201ee27a9e1d93eea6e7147422b93d8017ab6a92a3d116cf8ed364f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6abc:A3k03kHRJi56r9
TLSH
T1C0155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 928KB
SHA256 32d2b14ff54f2e0fad34a29a916400d69d654b445d98e8ceb57d20b20b76470a
MD5 0642a059ac26deea5051b5c4c200623e
SHA1 61b5b759f1006d761dba67aba74efc79815c8ed7
SHA512 14cb9cb428d09e7bba61d00667409615fd91d6329e4e3134418460b9733241631ebe61e85aaae602fcb66f1f697ca86135ee8c8422ad29886bcd9ec106d0351a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6aEp:A3k03kHRJi56rj
TLSH
T170155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 928KB
SHA256 88279693edaa6aa848c108a2db97516df3718f51aa6fa5b7b280f466ee7221d1
MD5 bc454107d4e5857b1f934b9c02853d64
SHA1 30510705d91cfa842986d4e91138b9313d72db65
SHA512 1332baad1a8f683396461970cb51e4d1d03499ea3553f9a216cd3ff265db3abd92fda0fe4acb61e875a88b6333628ccb0ed37386009d4ac81e95d7d83812ede8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6aLN:A3k03kHRJi56rY
TLSH
T1F4155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 928KB
SHA256 eab41f7726113b86e2c691f710a1ea2fad59df75d3e931b71943ccedffa0f3ce
MD5 3b7107f7cb763862de3e803f20754197
SHA1 596aa97fd51a8c8657180cef8a97613495cf335a
SHA512 877f262a739a8d8241f06e536123bfc720d327d830c50953fe75afb61d2167b29975d4b39005b898e07feccf50bcaacd0ba6551338986d6a899ae6bb7a38b899
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6aZF:A3k03kHRJi56ru
TLSH
T1B1155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 928KB
SHA256 c39daee064658f63ead44790a24a6eb979a418306e96d2f553009fa6c15689bb
MD5 b8401f3c05e45ac9189639e32e4e7387
SHA1 438ec2b52e75df18469419fa49f10edbef517181
SHA512 12a940f43c61b7784bfc276bf7142c3ab8bcf4bc254c5152db6ad6e7edce8d2bc76928a5952b47d6c2e7bd2dfea6753b4466d387b7d8f846dbdbdf8a24610401
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6ayC:A3k03kHRJi56rK
TLSH
T161155A07A6890FA8D11FC1788A968662E7777C121F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 928KB
SHA256 45a8014173aa47c01bad0358024cc47e68a3fc80ce1dfa10774a35f0b0333619
MD5 4117ed291d8b6a1b5f7a8e2e645cf28f
SHA1 d4a8207b05b279f1059914c1598c9e5a2bfb9f6d
SHA512 20d37c49857da6daa3e1c422eac0ef517243c30cf8c8173ce1509e60a7eb788956e4b9da3cd750e143a279ee92dbfe18187ff3b60593062a7b014755455ec848
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6atw:A3k03kHRJi56rf
TLSH
T18D155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 928KB
SHA256 f026dd2076adc8b9056005343c2af495b40998fe2321a9eb5bc9fda4ce239c1f
MD5 accc542974feefb6f223c9230a15cad1
SHA1 bd5d43c6d8484cb685169cc82fd992dd41615166
SHA512 57870bd954ce530e1909a4e96e0be08c52908af89f21c69930538b591b2afb90135e05b62cc3290b1e9ea4750e43a75918b30461e712caec4f37a656473611c0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6acT:A3k03kHRJi56r7
TLSH
T1F1155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 928KB
SHA256 390c946794f26c439a33a1cda6460b2542e4213eafb855ecf439b3beba4f8d8a
MD5 2931faba17c3450ec4cf58438595cd0b
SHA1 43655ece3854478963c15b98f59e6a32bf1ebd72
SHA512 6bf996ee6b83b432f7dd9515155ae30052988b1c17324075e441cd70ff1710729db44da9b1d0dbb4b95dec85d09c18ad1c2eafe7f9dd688df135577af5ab801b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6awu:A3k03kHRJi56r8
TLSH
T1B3155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 928KB
SHA256 6ea73a15f429462e4b0c6d596aad06bd29b9fa0601d9ff859a368fc65927d37f
MD5 c0f56a05efdfad9cf712ae8722203579
SHA1 8cee653a0c57306833a7387ab671d7f29ac1964d
SHA512 74ca7caa48061c5b163c73adf5fb6a00f0b121b626968e3f55c806bfbee30cf5b126be3daa2eebf2ebe0039e1d04fad11ab18f01a53ad840cc3eeb27bf0a3101
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6aOb:A3k03kHRJi56rV
TLSH
T134155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 928KB
SHA256 ca5dd6ced21ebcd605169a55fe26c461edf73edf6cb8c03997a919c998320026
MD5 53be92bd6adcdf2f56ca39e1fb64ebda
SHA1 a34858acae2820ad4f9082316b492b264d7951c0
SHA512 920f7d26e16bc7383c9a59db65087da2579fec957275372222a94b7bc4d14fc0b319734263a935dbc77f90c0422920f4a9c2ef75af652138242e2824c7baa1d3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6a4f:A3k03kHRJi56rV
TLSH
T1E7155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 928KB
SHA256 b498c344c6ef5ca95a35dbf17ea9cb22a16a595043a28a8cdd09a42511608120
MD5 1eb4c4fcb70d099325d3324ee4e22393
SHA1 65e28f65f913e9722c8dd70bd28e662041f4cc26
SHA512 565dd9c0b733d819570d5d3298e0e16c2be48a7a9e4c5d14c7c75033db0f956b6d0efcd0be36bde0aa6f2a4bedc9bbd361567e7fa09a812d0fed6ac47d095f18
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6a1K:A3k03kHRJi56rN
TLSH
T166155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 928KB
SHA256 8da559e6e3ce151b86f78adc4eb421ea8634bb76448093e7043921001bd9a966
MD5 dd4eb960f8202e900680c3a5aca14a11
SHA1 7e79e132632daa9b041b01c26c97dde1286e70cf
SHA512 436120a1d99c465d68da64a704d1da42b14d119fd50ee9a6ed7bd2b605caee150ffb5e046801788be7580904084007c1a1d04344c02886f112e8481dc96773f2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6a2k:A3k03kHRJi56rk
TLSH
T12A155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 928KB
SHA256 56cb789e376117b00f7be035a91bd59d53e2df83e83f5e9a28325235bfc2f0f8
MD5 7092a17a1fbc787b6826a37aa2990ab7
SHA1 0933bbe550a492a82c8b5f179f8f50b674fc8f70
SHA512 77f6d0030a6375096a67c6883344c24b0b91c86f44d37832e3ab4afadfee7cb7b0b2a22eac892f68f781e37f589d8ebfe128c4ff1600f956dad64149a8131e46
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6aT0:A3k03kHRJi56rN
TLSH
T197155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 928KB
SHA256 90a268b09159bcf3a7a69aa3ec1a885817de73e5da84d1aa7c21be5c70de21fa
MD5 752e3f770332fefac732b7638f44f653
SHA1 571ab9e66512cac4d12092d74cf8c6105720dbc3
SHA512 2e832fb9eb7498d5d4565a0b3d45538d27cacef671a47866a01c22a7e51989165dc290ea6ad4ca42c053c5da177c087ce2a2c293c2cdacece6db60649553af55
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6aig:A3k03kHRJi56r8
TLSH
T1BD155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 928KB
SHA256 76712ccac14ab786fcc99e2cec66609166d14cca769e2c1ba543b9a1adf5a03f
MD5 85eb21f6e01e41f9b6b49a6563576fbc
SHA1 71ccc8416a7b077c443952540fe755f7654913ac
SHA512 9267b2f376a725464ee311416811f502a74f61578087cef23092e6c0d8196941230f9309c697672ed478d35b0de74bf510e59c47a921c327d5d86438072e2b00
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6aDr:A3k03kHRJi56rO
TLSH
T160155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 928KB
SHA256 2312c1f2071b000bd818d339018d11306d071a51ec4f640eb578dbaa2a6905af
MD5 e44152c89347fff71c853f31cdc515c3
SHA1 6f8d9818ec367aa8f2bb92f0e1a0454334cf1d56
SHA512 518db65d20e9b707a1980f772412f2729496718cfb9e5109c00b16e921b911fd522165f08924e127ca71ba587391401b47facf874a37e3a5ee0b25279a08acb9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6aln:A3k03kHRJi56r4
TLSH
T1CC155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 928KB
SHA256 e99cf7ad9db31665166e00713e41c076c9047b4201180016493f0dedf6ab1233
MD5 b5d3fd136f5112829084699c1ee878b8
SHA1 61e212a856d5a171fb519f2b6f71e0fc54af4546
SHA512 842813c50587af84648e562ffc4023987095dbb59a1fdf145e67f56da0d428aceb0e5e5c04bac411a36bdb8680152ef7571aa379c977eeaec9c4df8c8b761677
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6aRx:A3k03kHRJi56ru
TLSH
T18D155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 928KB
SHA256 96ec4e5f3539475bc4044bec72161f35dea60880f1622c8c30a43d899855dedf
MD5 2ffc588a3fa05e9c690af38e8f2a1c4d
SHA1 2029e04e64f538c4dbdb2922508874a2d9380534
SHA512 172c68ad2d12502ffb9aee5d41479dd8c2d145041aa9a0ca5d24c672c12a10f13b4dd5ed810a76552bd4751ae0312b027438284ba1fc1f0e32c1168db10088fd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6a/A:A3k03kHRJi56rl
TLSH
T14D155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 928KB
SHA256 b752ad63909292159f091f38a2ffa0c78665068357e1a1f40fb36100f989b4f4
MD5 567e5ebafb489c700c19a7b4942c40de
SHA1 c4decd3b80099993a55630be618b60d0eb38ccb7
SHA512 b7d4b24303831d6a4bd49f2b234c9e3769cadb826665ab2398c59f6be0e30d71869f946b7f71f8005dd2f7d5b56b615a94bd379397158bddc40275860851477b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6aQ9Q:A3k03kHRJi56rE
TLSH
T1F8155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 928KB
SHA256 83d5cdc2b44d3f051ee308f3e04885efb213f72d19c282c5ab2f61e2f2a8f54a
MD5 7ba0dc01640884a2d3f23efd7e417593
SHA1 9b59e7aad5b58d8acbc915f278fc5e2091fbde11
SHA512 f8fec7fe165ee7063aa1ba401de8c3d6ed9fc6b93b3315d012547da7916fa7b2621d34cb939af0ece2bbf887d87ee27a349d240972a436b808ef4a7453813455
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6ax4:A3k03kHRJi56rv
TLSH
T1E4155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 928KB
SHA256 15ce910f271ec4c996b6efff7517ecfb030c5542fc68e384d76f0bdda75d297d
MD5 1fcca141bc02a0e6efff10d7db3cbdb9
SHA1 db619b19e3d968670883fcda844152610000f9e0
SHA512 1ab616c3a5f9a51578ca166e904a485515a869f6971d9e5e6067c794e0f5d6d3d4ce7aa527cb2456665755935217e33a74f057ca1a17e4e57c80649134c1d9c1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6a0u:A3k03kHRJi56ri
TLSH
T10C155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 928KB
SHA256 e482221cd4954a8d21610a83f66746e6900b82333cf06be8c1c3462ca88505fe
MD5 8afa73b0e741cb3abe17aa7eaca3c531
SHA1 294ada75c7d6b6a656c056d63554ec12c0d7ec37
SHA512 2abe339e44255965bf62b3351bdb4a96947fd5b5c8913f8aef21fabbf4905802050d5b2bdface6ba1c34c66288f79a02742e5782d4d1a1f7f0a5e3c078b79561
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6aFj:A3k03kHRJi56r8
TLSH
T1DD155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 928KB
SHA256 e8b163263a737ca9a57d8c24979fdf840a433002918f891119e15b072de9efc3
MD5 de50c86cd52da97ac580819a22091f75
SHA1 8d60900e8e96ccb5c169a6bbccb748dfc0ed932b
SHA512 dff90872119afa32360b6979dc97efc23c185f93f96c3998c8d54c55435360e158ee0395a037ccd43cda079b4ea9747cc604f945973859f4ffcf97f5bb32275b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6aMg:A3k03kHRJi56r0
TLSH
T1B4155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 928KB
SHA256 d238ba95890cc151cab82f262c698280fabdd107f26f1544a0b8616872c01398
MD5 906aa8bdf6a581486e99c2c7e59a80af
SHA1 b868b653bec6a9f0d2b91accf11a5af2f422f152
SHA512 64a914df4dc089fa09a0ce9add6257f0ee6e742d6f09e092962ce024acfa169b1610ead147e7873e9290fbea4fafb98fab19a8c7635b208ae9bcbddeec08a450
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6aTI:A3k03kHRJi56r9
TLSH
T181155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 928KB
SHA256 65207b893e989e17f18f28a345e6bfb6cfb782a476dcaaf95cc50148e1072010
MD5 20edeac3a4e184ed72cbfc1463514134
SHA1 9c9d0230cabaa2cc552bf02f668b085f0ee95c0a
SHA512 7e05cfe831ed452292fd57feca44146967d69086310d0191989e5e28aaa47a30d6b9be9698dce5993bbae84351deaa15a216e152faee69f752add26509054882
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6apo:A3k03kHRJi56rb
TLSH
T17A155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 928KB
SHA256 3ff3c230da477454644418f1140a327a019c5ae74c505c866b25c78e737b9499
MD5 b874356580de999da185f073d6f9a664
SHA1 2f300e51032f533fb3dae39dd76fe716f35bf1e8
SHA512 fda07684c3b24b054091c1ce49bc041e3086edddc8a6012fe0f70da6b90b5ccf1e178eddfd7ddafbe16011a0d537afcc5e3f85be5bf68708e9155a665c5e4616
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6aa+:A3k03kHRJi56r+
TLSH
T13A155907A6890FA8D11FC1788A968662E7737C121F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 928KB
SHA256 1dfeff8e64fc820b2891158079d3962b51a98509f7c35d67fdd65bca9487ce50
MD5 1be32dc3b5a9f9ef36484b3e59de74f2
SHA1 f4e79191d0ca85f2ee278c94bdda740efda482cc
SHA512 8a48b7c21c09721d90387aa304f5a0f218b44d8c4497082008e420f364a62088e937fb72e58441608b9c75f368593245187c52b6d83b9e54983d1d662d7fadcf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6aaQ:A3k03kHRJi56rq
TLSH
T1F6155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 928KB
SHA256 06e7728e69d669d627417b04178146e01915b85655c575b71b6d878476f43a41
MD5 df8cf453a580a123fa0cc66f9a0a466d
SHA1 f43f129502e70ec3e0ab8b6c2d82b3ac183d8c3d
SHA512 54fa28ef3f527cb97ef8670a110b329fb0fa4c965312a616f29bae496800a0aed10c88e1170deba056c5f43386ff8b850ebe287fee824ae365cf0972d5fc3417
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6arX:A3k03kHRJi56r6
TLSH
T1E0155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 928KB
SHA256 959930ce1ac0683fb206777e0aad55d95ca144d2c37c9413ed708c07368f0340
MD5 569fc69b6a92f690b86954ac839b1841
SHA1 56d2dca301c352a782700c48cd9a5ef769743c2d
SHA512 8204e02e0c44b88dd8d3cbb9af0c02c396ae131e5fdfe8f4cb7f3aea14154cf8e9ba76a79c430de453752cfd703d5f4696e5870af5838d31989ec15ddf9617e1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6a5L:A3k03kHRJi56rU
TLSH
T16E155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 928KB
SHA256 8c68a9900d8444d2b8bbaac9196eda8cce940cbf2039e3e86ae46cf58b234fd8
MD5 6a44100e8d1dbe0cc55ca131abeff129
SHA1 342ded84b4f6883064d37bd09b6e7f0afec4a02e
SHA512 581caa5577d44de6fae0de7709791668cf460514743050ff2c76b161a88c98e4b85006003a16f7e25c606302e326b929fda9bddd6fb54804481d277a23da76d4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6anM:A3k03kHRJi56r1
TLSH
T1F7155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 928KB
SHA256 47a3549f3d775dd0d316524750342b64c3c1bd71a3eaedf50243c803cd2ee043
MD5 aa5fe7b3d5b1eb0e784ed21f10f4cbe3
SHA1 b014ba123dcf44d90695269d1277afe07791daa9
SHA512 372ff6e67152f905004e888545cd7d7a2993bf70edbb4e12fd2c088b6972791c96b54171a62de55d654c57a095a598f03a929bfb41099c2edb81f4a41ba22855
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6aQh:A3k03kHRJi56rP
TLSH
T1B3155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1524-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1524-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4780-34-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads