414bad402c816717e84f862d4cb37c3258628ec23219426bcca2a3c4966e7b92

Analysis

max time kernel
110s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 17:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_532e385dc57e29f5af57dbe956d14b4d_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 928KB
Sample260708-wjhtnse161
SHA256 414bad402c816717e84f862d4cb37c3258628ec23219426bcca2a3c4966e7b92
MD5 532e385dc57e29f5af57dbe956d14b4d
SHA1 c5e992c3da76150837e87a64d2d92be85909dd01
SHA512 a6eca079b0b977e9aa53754d3cb22ece139c294161ffa7bb109626d5c58beb72e67ab0ecfcdd9bb3fe1e5c24ada661e5bf701dd79a9a1651650e4fa3e4a25ebc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEN:A3k03kHRJi56rR
TLSH
T1C2155A17A6890FA8D11FC1788A968662E7737C121F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/2056-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0006000000016cb6-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2de-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2056-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5692-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2ff-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019ca1-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018995-204.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018993-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a72-356.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985f-477.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-502.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-605.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a71-630.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-721.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-747.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-828.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-859.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-878.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-910.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-923.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-939.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-979.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1023.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1055.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1110.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1141.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1216.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1325.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1344.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1406.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1408.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 43 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0006000000016cb6-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2de-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2ff-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019ca1-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000018995-204.dat	aspack_v212_v242
behavioral2/files/0x0005000000018993-259.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a72-356.dat	aspack_v212_v242
behavioral2/files/0x000400000001985f-477.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-502.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-605.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a71-630.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-721.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-747.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-828.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-859.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-878.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-910.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-923.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-939.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-979.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1023.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1055.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1110.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1141.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1172.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1185.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1216.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1325.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1344.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1370.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1378.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1385.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-1402.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-1403.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1404.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1406.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1408.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5692	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-08_532e385dc57e29f5af57dbe956d14b4d_cobalt-strike_conti_elex_hijackloader_vidar.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-08_532e385dc57e29f5af57dbe956d14b4d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-08_532e385dc57e29f5af57dbe956d14b4d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-08_532e385dc57e29f5af57dbe956d14b4d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-08_532e385dc57e29f5af57dbe956d14b4d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-08_532e385dc57e29f5af57dbe956d14b4d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-08_532e385dc57e29f5af57dbe956d14b4d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-07-08_532e385dc57e29f5af57dbe956d14b4d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	2026-07-08_532e385dc57e29f5af57dbe956d14b4d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	2026-07-08_532e385dc57e29f5af57dbe956d14b4d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-08_532e385dc57e29f5af57dbe956d14b4d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-08_532e385dc57e29f5af57dbe956d14b4d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-08_532e385dc57e29f5af57dbe956d14b4d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-08_532e385dc57e29f5af57dbe956d14b4d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_532e385dc57e29f5af57dbe956d14b4d_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-08_532e385dc57e29f5af57dbe956d14b4d_cobalt-strike_conti_elex_hijackloader_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2056	2026-07-08_532e385dc57e29f5af57dbe956d14b4d_cobalt-strike_conti_elex_hijackloader_vidar.exe
5692	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-08_532e385dc57e29f5af57dbe956d14b4d_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_532e385dc57e29f5af57dbe956d14b4d_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2056

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 928KB
SHA256 414bad402c816717e84f862d4cb37c3258628ec23219426bcca2a3c4966e7b92
MD5 532e385dc57e29f5af57dbe956d14b4d
SHA1 c5e992c3da76150837e87a64d2d92be85909dd01
SHA512 a6eca079b0b977e9aa53754d3cb22ece139c294161ffa7bb109626d5c58beb72e67ab0ecfcdd9bb3fe1e5c24ada661e5bf701dd79a9a1651650e4fa3e4a25ebc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEN:A3k03kHRJi56rR
TLSH
T1C2155A17A6890FA8D11FC1788A968662E7737C121F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 40da7ad5b89d3331388695c3d3ad9eebae5319d001398fdc6193c65f57d06cbb
MD5 85d6f496cfb81f7e5f308ca04f1e85d7
SHA1 479e2b359718952dbff1d27dc822284ed354ac98
SHA512 14e03466f61217df692cc5cfb6adcd6e45374f9716ccb8c9b10da8e7c0bd4634492e3e09dd16a00fe9293572b85dadb3c2f836c0629e1c42ef6a47290e9cc995
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEZ0Le5ji0hmxNrM:A3k03kHRJi56rtPji0Aj
TLSH
T1A7655B16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 942KB
SHA256 43c8ad06386933a985f7605af0ffeeff4cfea1f4f51c7de97636111278c1f33e
MD5 a04eeccb88b0c7663c7bc8313a7b7447
SHA1 6cdb5c958c05a6b55627d391063a0b915825971f
SHA512 51fb8de05eb18c36c379596121f779f45d8a4eabcda5de92380e2fbe3124f56564dae1f9a05d3352cffff7bed796e4543e3e053f13579d10737abe2d725ab7cc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCELa:A3k03kHRJi56r
TLSH
T1EB255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 976KB
SHA256 e013522e6d131899d9d82c8c5dc9a0abec603faf914d446b351a865206b209a6
MD5 ac32489a1015772add92d8efab672b32
SHA1 8d559ffe4a52679e13745f1e292c2d1f73852daf
SHA512 3a591c0e1bf116ef9c4e2754b63a3c6b87a3b63e4e044e1dd219d8ae9eefa7fc3386d9f403a539437b1f2364d3a73fca2712e0d53d5f0e8d79c7c10457b00cfd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEIb:A3k03kHRJi56rsb
TLSH
T194256A03A6980FA8D11F81749A968622EB777C521F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 951KB
SHA256 2935d525b0ef8ee451821ff99d02a1747a4f8b518f5f71910587f7322964cb09
MD5 95dbe4ad777be903876c7421c3240712
SHA1 55e6e13b5d60bd8288a54ac4f1e2c6c893420ca5
SHA512 3a9ab7be01dbd005769d8c3567bad6bb837138654411c29c9683610a09f2a3bf77f51678cd8f6a8443a3359a24221fcf9d1efa147bb0359efd899ed0e1e40bd1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEzZ:A3k03kHRJi56rB
TLSH
T19A255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 951KB
SHA256 eb04259f115e899b733fca52bca8accc1c7eaabd700459dfc96f5d6915a55d89
MD5 484ca7806f974800d5f46c169b72157b
SHA1 348d6c84766333f51f7bb23475360e92bd0018b2
SHA512 ed2df5c5ee0013f02804c2373090572048040f14c240725df538fae462d2cd7e811e6b0a82f370a32ab12b830234167a2186bcdd25449dd295a78a1d560b8354
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEo1:A3k03kHRJi56rO
TLSH
T162255907A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 951KB
SHA256 6c448680a8d41eca3386d5a62193c167de562f0ed69cd85d96a39c00a9cfacf1
MD5 a5d1b8845de8b28c010dc409901fa909
SHA1 72fe12239d071420e8e186d09bd6de6ebe0e733a
SHA512 de3b40eb572f595518990a0312aca1b22a73e68265ef129328345479c799f8c14416e19525a185ea5c3595dd9fa033de843decf167b1924778e652800a8a76a1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEK6:A3k03kHRJi56rJ
TLSH
T1DD255A17A6890FA8D10FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 951KB
SHA256 5476cc86998a1973962bd35d48c27fa0c12bce9523482e6f24aee83be2d37827
MD5 ebf5c9a4ef10183d337699d5858760c1
SHA1 017e6ac68fa4612b985418d0f72aa0c707431fbd
SHA512 be41bdde53604d7194b8e9bcd5b1f2be14a0d0e60399eff411f6f4c24c0c1f286702f3bb3722775949712cec960c46852d80d60940c116769d68bf9829969ea6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEiN:A3k03kHRJi56rw
TLSH
T1DD255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 951KB
SHA256 6b6f6e75ec5e9e3374f4d584e486db083e2e16e5d3e6e4768551c02228bed418
MD5 9b4ced751357041356c6a292905bc1ba
SHA1 a333f1c088d7776ec1eeb51c0bbd06ba1f303fcc
SHA512 ede7dcff1417650a62f425a004e65d05625ef464cec4dad8a610b3c0c9fa4f181a5daa663442b9088e5fa72cad3595fddc955ecf0bee587304bbe35bfbcd92dc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEYf:A3k03kHRJi56ro
TLSH
T138255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 951KB
SHA256 2fa72167294c05dcbf48861f0f17d06c04cc01456e8c5035643ccb726b73a9e6
MD5 e76cb4ad8bba584faa1ceb3331a2f801
SHA1 4f493257607d083270059be776ebabeac0b27300
SHA512 e834dd9aec414105e079914bb65b8e6220443c11eae05516b1d05a5e5ef8d1daa939eda3e9b6bb93257c5f6528c272249f48ac7e1ccd9e139422d68b8fa90b17
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEyo:A3k03kHRJi56rV
TLSH
T151255907A6890FA8D10FC1788A968662E6777C161F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 951KB
SHA256 691811f1024931f3d286471157246f66724759437c8f40288c7eab64748e1531
MD5 7f5dc9a2e5292f78f25486ce1d58ace2
SHA1 dfa3b307ccde7c8cc4dbe86e7ad5948c9cde389f
SHA512 091b32bf334a13b9b92e0e0f4d832975d305ca742903782be7f0dffeb5bd7f759167904d32ba2ad492ae23a068b8f72e9032939b2cc32fc99292a10cce55ddf4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEmu:A3k03kHRJi56rX
TLSH
T140255A07A6890FA8D10FC1788A968662E6737C165F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 951KB
SHA256 2007ebb4ef434846a0259454f20e4da638faffdc37882d71b7c21f84c6f45b0e
MD5 58d7a0acf4b078010067a351867b9201
SHA1 3a60be6039dbd77a90a7e2cfca63b2bedbcc3ec9
SHA512 d0052d516a1b1fb12f54f1b35053c47f4bbab2aebd9645ce5ba21211b73a94268a900bf8a9da3df5e5e5f33b8a61cd04b53659185e9c5c20674adf00429de301
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEa9:A3k03kHRJi56r2
TLSH
T16B255A17A6890FA8D10FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 951KB
SHA256 0d6bb4d95c5213beef12936346241560660804468e0655c89e671416cc64dc22
MD5 980f08a1e3067b9f55af9bde84c5a8c5
SHA1 488921ea6d854f898a269b47827ccc17783ec769
SHA512 ff6bb9b87ac6f8eb8217eeed78b792fdd757c28384c297527caab8482a1ae87a2d0611b43b97f1fd1b0bfc1bf391b96a3ba7a1e779998b300077b8aa1cfe9004
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEac:A3k03kHRJi56rb
TLSH
T1AA255907A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 951KB
SHA256 9841a1b5777fe27abd7bb26e0d396b4d8f98ba7a50f3c9212a9b0e729b49d736
MD5 0bf2829b5792fa90e131a00d12e4c5e8
SHA1 2c4a3e1f0fcb3f714d34d7f07fd414e034dcf1b6
SHA512 77569e0ef9020bb8e5a2efc5b2aa86137a57801b8576ebab5b33cd786edf2658002343e9bfe2d7658c945011282d17fadf253c3bc01eba426980b5d53682e1f6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCETp:A3k03kHRJi56rZ
TLSH
T180255A07A6890FA8D10FC1788A968662E6737C165F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 951KB
SHA256 7e01b271842edd899ddddb896baf14cdc438e73972e26e781a29834f4abe77b2
MD5 f83f67a09dfa591bb30ebd68afebef82
SHA1 2cf10420aaa63c04fba8d43a061746a176fbb5d4
SHA512 db7be4d8381d0b3072baedb36bb4a46d41d87332f87ba0848731e1a1250791f9d4160e299fedaf349d84a45103bdf964e8fe35eff56ffc7c6039f960960b3edf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCE0N:A3k03kHRJi56rC
TLSH
T14E255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 951KB
SHA256 5d4b415bc74ef3c8f8db0edd4c2cda46d5185ab43165dba4f27b24adfa4f116a
MD5 cbee6f116a00f528b508d441ea70f3da
SHA1 f0b566b814ca714ecdbdb0f24f7b454f1973f534
SHA512 de6f3d274ae6725f4f780eab5241ffd928340e2b832e0e718ae385794a632c98e9e6ffa2c6e03e3056ad09066aba481571382e288a17c5c3b28ec25afd07b78c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEcF:A3k03kHRJi56ro
TLSH
T128255A17A6890FA8D10FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 951KB
SHA256 10f07d2781fa615459dee902ebd37faa3a502cc5830b6a36ef55b86b063b5207
MD5 338ba8a1725ffba75abca309c47f3059
SHA1 7a023752ece03263403384f81e3335914ebdad93
SHA512 4c49b7fe041cd59f720436fadd77ba870e8280c2571f8c8ca743b196e52b102095468d4e7fc80b1e5a5c93ab1f8d3ea0dd2f85714a591ec090eb86a552d39da3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEJC:A3k03kHRJi56r8
TLSH
T103255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 951KB
SHA256 740cbeed9380b306bde282746cd147080fe2a54becba22efa85a08663b94be6e
MD5 cafb1e75f96be899f77297bd812b2a44
SHA1 ebdfac0c2b74a4a4cda46c139d0782ea981c9be6
SHA512 075047248e7ad35047881589f6bde24cb8546f8ba29b591efdef0969c16de228cee6255f377c4d8c6e5c3417f7ee91ed28bbbd1b15b0c4887b02bfe9e8029bda
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEqw:A3k03kHRJi56rx
TLSH
T141255A07A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 951KB
SHA256 f3dc2424bb5cc093943b6a71792ee14dbfe878556f3c5edbc9bb3961bb2969ac
MD5 b945429bf7d780380ca5ad283517a024
SHA1 cb8ee839be14b7f476e3c6fe69e79e4b34c12a1c
SHA512 c8b633d263234355a17aa28a947252ee8a7690cf90967ef5a81576a345320cef8ee2ef71da1f1cc45c6080a82ab89d70a1fd4026ff6d59a15d61c3002e4f5136
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCExT:A3k03kHRJi56rl
TLSH
T149255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 951KB
SHA256 da1ff8be03cca8c90538646f896d8c43a86a3de2ed9dd7b43157cfbb213a0a28
MD5 7423b3e2c49de0034dd148e1a02152be
SHA1 6d7f3f78f77198367966f7f4b8c7c5f9f3016c4c
SHA512 24cf0075ebb49b00b500e31d2a06f62fee77adeaf59c87151df7233f4eb4ac3fc28aff011582db6c1af093be2ed07e2ddf0267de3ae2c68bf31e2176ddc0f55e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEfu:A3k03kHRJi56ra
TLSH
T1C2255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 951KB
SHA256 0b5ea64860c83a494bf7c0cc294b82ca60fed695b63e254a2fd37021d6d5eb41
MD5 2f4162241a7ba4a1e1a073f8a7ee090d
SHA1 6cfeeb45d451b4948fea90f48c5f2a768b5ca08c
SHA512 851faf3105fcace3870e27b2d84c4aba051f4ffe0b3bfeea2144dd308c4c37eff590b54dd9622be0e1ac7869c5ac36d2c2b93c94f48427a522cb9ca1478b2595
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEDb:A3k03kHRJi56r7
TLSH
T1F0255A17A6890FA8D11FC1788A968662E6737C121F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 951KB
SHA256 1acd06a73448b0f96e350366f9af74816c0a18290742cd0fe34d236f71488c66
MD5 e3775ae87226bcbb5b7059375e5033ee
SHA1 a6e003913d5ee908a963cd65ed756b1623be6914
SHA512 ffa79ec8054e8468300d320127c55fb6a404b06e828b45989d604c8dc5786da675994673fffcb99982bc40ac44bed0418c235fb2c2d7b3150f97635233c9bf0b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEXf:A3k03kHRJi56rD
TLSH
T160255A17A6890FA8D10FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 951KB
SHA256 176720b2372242c4281f18a6c1b5181a52fe11a7e3a6c77df3c543277e654708
MD5 b254c7d2a297add7656a554c373f81b4
SHA1 d6242d545ced26a354cb0b244fac147022ae5018
SHA512 ecabbdd6f124aea86907dc37aa06b9ae08ec5280970c127a1333db654addc2277efa941e2959fd8dc611bb427609f0a6a8c9023dd0e1bbbfc4de9e2105a52386
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEgK:A3k03kHRJi56rz
TLSH
T1E6255A07A6890FA8D11FC1788A968662E6777C121F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 951KB
SHA256 6d405866754a335038487bdc8f10441176f3ef9504a0434c0daedcfc9dae1d0e
MD5 d8b8b60d6e9d4fe53704975361674c35
SHA1 3bbab743d160c67d658d40061df3d78aef4c1055
SHA512 9f18802b10db9eb6c4391f56fc157ea723aa774484ebaa2573a87c7f4c940035f1f9bad8cc5f58a1d7a0113353b86d3454c7a2e4ae408bcebeed672399ac66b6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEdk:A3k03kHRJi56re
TLSH
T138255907A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 951KB
SHA256 2e703904780407fac448b1f23ff1f8f19e499fd8815ebad4cda39ee80845d405
MD5 4f64b61e9729c40fcf1ec73f31d017ce
SHA1 076e9d33e830931d8481676949ecdbd06c7a9aca
SHA512 559828cfe10c508ab9c7e29d0e485245b349f3dfb5568864e19111f5be2752f3cea65832e141edaec593f8400a52248f0cb9171763ba40a38a78593ce928177c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEC0:A3k03kHRJi56rD
TLSH
T1EC255907A6890FA8D10FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 951KB
SHA256 429e5afdcd2fbc3fccc9de4854259c4a20ac26cd5be101cefd473d9f018645a9
MD5 60ce43b8bf18c1b50ee67bfece64223f
SHA1 6f20fa79b662049da3a60b60052b43c9b4a471ff
SHA512 31e2ca5cf21a2cff0ef612cc135a2d95e1da1a1a31a1671ec3370af05728aa4f4cebaa01f5d70d635a93cbc89bb89c812a046101d6aa8f246ec1deaf8e419fd5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCERg:A3k03kHRJi56rm
TLSH
T1D3255A07A6890FA8D10FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 951KB
SHA256 f4e55b2213e95258b770f6ce79472fae003fb08a228fa7b66ea81b4c0dd4664a
MD5 c0629ca0e7fd3c557b043f79dc6c3b9c
SHA1 8f0f19277affd3b6a74ad408b62421c777850d9b
SHA512 4b8c9a02f4566ed059eddbc91e7d976c0e75c432dc6d1bb20cce5b3d03f7156e58247a11380146ec04144b371b06f5b7ed11be1de0bc0186ed31045f29a08335
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCE4r:A3k03kHRJi56ro
TLSH
T198255907A6890FA8D10FC1788A968662E6737C165F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 951KB
SHA256 12eb99f7881bbeb5dec66dc127873302346ccebac04a2b30cfb9bfd44f0e73a5
MD5 99ba069773d88913ae2bc22938568573
SHA1 693fc43c8bb5c4563a46839f6a9b96ba56f8d8d2
SHA512 83bf3524827a70ec946ef0d8edb8873f361a539aa7d6981aea77a98a1031199e65326a4a2d3ed8edcd56ce29d1a41f2958aa3f1748e1ebfe706ba30b4bb5f490
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEWn:A3k03kHRJi56rK
TLSH
T160255907A6890FA8D10FC1788A968662E6737C165F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 951KB
SHA256 d2eac1c45f53368801ec0dde92f9fffea1213278e8d3ccd2b5e62e151d030016
MD5 99d9526d357cb5a241a823595ce6ee75
SHA1 1b152e3d7e4234b2569ba3aa6d6a8890375473d6
SHA512 c0c0c4c630de4d16f98448e210a825aa8f43600d720003f2c48e6128aa7f92a4fd473e0acde35ce6ca5d98285ac3e4cb467f2f106a9b5a1824a128e9d5307416
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCE8x:A3k03kHRJi56ro
TLSH
T156255907A6890FA8D10FC1788A968662E6737C165F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 951KB
SHA256 a24a2a70428e5105973ddf775ac5e8bd7fd1a62182a61b7594e04687dfa9db17
MD5 01de5671e9d045fe3bbcd4370773e908
SHA1 551364154478b969df0120a847fe72968800812c
SHA512 2bf53b35b34684197b18803422d9ce692b921bbb7ec0df775b85500eddb49649d974fac4b453888d3c60416eba28091601109456ed8f027c7c8f661008b7b33a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCE2A:A3k03kHRJi56rr
TLSH
T111255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 951KB
SHA256 62f3574dbd237e2f681e5daf3e5cdb7be7c14b9343db1a3d36161c2a6979cdbe
MD5 c64d387bef2208149573b653596a9e22
SHA1 881d96b111c75a4103a0aa2284fd514158797138
SHA512 96216a6ec9643d1a96686047c8f95392d391f55186d467a2d2dcafbe50d18f23545d4310ed3b0fe9efe97e00b3196a214cc467008c1d6dddc5249499b3527eaa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEv9Q:A3k03kHRJi56rm
TLSH
T18E255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 951KB
SHA256 b81af7c8eeb30c92b2e4c0651e263a85726d101d25df7027b2af5234a8fa761c
MD5 e5d07daa3024591c6ee378db0c367c78
SHA1 9c8519d0839df7b83ba4c13a4069d9e1afa01962
SHA512 2ead906d4afa9a8412a3164ee4d84769fc6b1b9862fe1e66da2095c2ec0f3e307fbac2c36b5ddf981cc1052454b7488b5cd718111297161f59fa4d9d002171e6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEG4:A3k03kHRJi56r1
TLSH
T16D255907A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 951KB
SHA256 c55496b59d048551adf4d9020e8adbeb193d3adba95c80e0f6f67a00e9d12cdf
MD5 0021f72dfa1551aad34096f0b78703d7
SHA1 24747cdb0da78e9850f2b6212e8bb8cd657a73c1
SHA512 d7efa5624d20c72bae8f1daeb628ae27fe4a2acbf2a6806e01d832c1d71a5e2bfee751321232e51537fc9668564920970d8a201ce129d05ba2b6498dc676e919
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEVu:A3k03kHRJi56rg
TLSH
T105255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 951KB
SHA256 004317f371becd83469689e2ab428fe3140709bfbeb20177efad83bdbad6e150
MD5 f53e8399e618e10f7a0a237032d59f12
SHA1 5d9e727f9e06165f21db2a79aa7097c2c9ef3656
SHA512 b1c1efb6f330a5507fc7d9977effbb797dd3d4166e024378d974b8c258e180a84c68bf6cf673633d7a11fe03ad1b26216e8ab34f0dce38bcae86be7ad5c4c525
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEIj:A3k03kHRJi56r6
TLSH
T141255907A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 951KB
SHA256 a87512434a77db6567fe783a99656f6580bdff3f343b3dff279656b3aef3109d
MD5 ee0c0fb6985ef2e6a4866cb4bcc6a854
SHA1 3e4292520a6c23f494a95af6393a1d88eec71891
SHA512 63466f2489897b85bb45af446dac51d4b835854a73d94326f3b9300b6fb1cab9c18687aafa4e9cf578c1e2b410ce03665ff14a8b411a867d72353a918f172b5e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCE5g:A3k03kHRJi56rO
TLSH
T1CA255A07A6890FA8D10FC1788A968662E6737C165F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 951KB
SHA256 4d73496d06eedc30dcb51d1883f8601ff46d010d6c5f5d2d1fcd6f35ee03ee85
MD5 c70d125e4a9db484293c4cb7711f9f20
SHA1 107bc3cfa86d565d7ad9488927e25b604114f001
SHA512 f7900337324e456eafc9d2dd3788a8be610bc847c1c53c566ba46e815dde728a928b628781f7e9f7f00fed857c2b231fa4c21cf7eaf776341236fd0c1cef1d01
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEgI:A3k03kHRJi56rH
TLSH
T1A4255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 951KB
SHA256 a9aeb2df2a8c9357c1fbaa13bd72d546487fae83a4832c37391cb6e7e8d45159
MD5 d2dca72a68853d7b83fa6e1329cb2549
SHA1 7f25088cc3004d332ace70b3a1e7d81ce8c290e3
SHA512 93f15d976d56234534203cda4c8cde368e00197c767fe4e0af59f02874a6bc26c41f76335a0a8ad94f07a1616845eac64b30f6fdde40bd201bbba97901c6f6ee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEio:A3k03kHRJi56rB
TLSH
T167255A07A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 951KB
SHA256 4155223f618f638c64c974782a72dfe51ed2f5c51785b9035bdd1c52b352f2c4
MD5 721750bb2b49cbe572e08d76e75a6673
SHA1 588cb81d41218dbb34394eb7ca45cb4f12e44d93
SHA512 a465d318effaf7b15a0cc311b6a5a54f1bbcf9a7641abf6b1537643c50d3dffff9c1b3cd9a4dd6a7005662c7194e55281754087103544b31e7fec864388f884d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEZ+:A3k03kHRJi56rE
TLSH
T142255917A6890FA8D10FC1788A968662E6777C121F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 951KB
SHA256 5b0a79ff85e84ac2771af6545f8cd52f6ada95179aab8bf1f7bd8baad92b8049
MD5 73b45c3b6511f2b3d91d633fef95696c
SHA1 186f94f7f6d289b07f9718e42b83e06457a2f4db
SHA512 7f40f3addee304fe488cb4456f47df17110ab13d00912457d5e79503201d0ef557e28898c78b6380888c3ae68468cbf083aa6ba82101f16f26f557dd7318a224
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEHQ:A3k03kHRJi56rM
TLSH
T118255A07A6890FA8D10FC1748A968A62E6777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 951KB
SHA256 b561e6e956a437299b5fa24f3c3c677e42c9c1d52842ddc52ff55d0d678fbe22
MD5 cb52a35fb31aab26ae8e0c002e64adaf
SHA1 f562a3b0b27191a38940342a73fd1c66ff9bf86b
SHA512 bec1e468070aeba8d84321576b2069b6f82f3f8d5657dcec34d1017c728b626e5d167e218e0f6e1b529bac511c9587a4ad624bab4089a1d6e64681d050bea883
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEcX:A3k03kHRJi56rM
TLSH
T12A255A07A6890FA8D11FC1788A968662E6737C121F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 951KB
SHA256 498be5522f6567d254bec876eeefe9558271881b8d35c56c85a7d10aad887b36
MD5 862577f63b7c06656eab89f22ca6468e
SHA1 e9e2189fe87ac2eb57867b94ca891727700cbbd1
SHA512 55cfc7006cb1f85e7864725fb223872d3d90c3bae129f3435e3342039b7b482e648877b34a78bccd3a60731825f676a0028328de21fb40801f4d77073e2b3175
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEaL:A3k03kHRJi56r2
TLSH
T1F7255907A6890FA8D10FC1788A968662E6737C165F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 951KB
SHA256 9ca8e452ee63dfa034193422e02026eea7ffb9c62daf3b3153f8a75a9137fbae
MD5 32184f0e935ef70c44125d3a4d803227
SHA1 fa99db1eeef0bb7fda24b2f7d395477ef7c17342
SHA512 1afa9ee4e7b6880a5dc4c0a1b02c8669d1e4088da6b9f09c91a05cf41f64ffb230537c93dd7911ed0f114f56753f6a3be3220638c9b0d319e271816541f4ac12
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCE+M:A3k03kHRJi56rz
TLSH
T138255A07A6890FA8D10FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 951KB
SHA256 b45d8477455148883ba08676e48f061417742bc4e848bda9de8501ed6f251145
MD5 6b1410718940cfb9211868ad0b189ce8
SHA1 a000bb4cff406e0f759a804ef050aad46eb889bc
SHA512 16b3a130d028616494f26ce3e5512aa562dcf60fc18515341d979370c9f0ff44869d9bc9b004fd37e8ca8b76ceb87cdb0a6f41ff448613795902e63d5473e4b0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCEnh:A3k03kHRJi56rt
TLSH
T187255A17A6890FA8D10FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2056-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2056-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5692-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads