6f21bae40790003774c7d2f0fc4c0e858e0baf00165506d04ee42cd297a93cf2

Analysis

max time kernel
114s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Size 2.5MB
Sample260712-re7vsabs8l
SHA256 6f21bae40790003774c7d2f0fc4c0e858e0baf00165506d04ee42cd297a93cf2
MD5 1cb32b48dfd9490eda23f26393b931a6
SHA1 fda564b0891216412a1371fb57f3ac26cf4c046f
SHA512 13f5b1fa3499648639cd918f74f57656e4fdf200ddabdefcd1c9ab2fa3f295ee68cbc5af42028af0f9fa166afeb6c8fdc1892ce738f59985fc490c85851ccbd6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOai45EWTQz3N+tCn50ChWdArKa1Ze0p4V:A3k03kHRJD8tDZqrKWeW4SkZP4sz9Mb
TLSH
T14AC55B16F6B843A2D07AC075C7D69A76FA7338450BB086CB0384D33D2F276D19A79726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/4380-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c43a-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2a3-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4380-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3344-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019958-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019aef-653.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000800000001ac2b-1255.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 5 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c43a-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2a3-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019958-491.dat	aspack_v212_v242
behavioral2/files/0x0003000000019aef-653.dat	aspack_v212_v242
behavioral2/files/0x000800000001ac2b-1255.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3344	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe$	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	patcher.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4380	2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
3344	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_1cb32b48dfd9490eda23f26393b931a6_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4380

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 2.5MB
SHA256 6f21bae40790003774c7d2f0fc4c0e858e0baf00165506d04ee42cd297a93cf2
MD5 1cb32b48dfd9490eda23f26393b931a6
SHA1 fda564b0891216412a1371fb57f3ac26cf4c046f
SHA512 13f5b1fa3499648639cd918f74f57656e4fdf200ddabdefcd1c9ab2fa3f295ee68cbc5af42028af0f9fa166afeb6c8fdc1892ce738f59985fc490c85851ccbd6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOai45EWTQz3N+tCn50ChWdArKa1Ze0p4V:A3k03kHRJD8tDZqrKWeW4SkZP4sz9Mb
TLSH
T14AC55B16F6B843A2D07AC075C7D69A76FA7338450BB086CB0384D33D2F276D19A79726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 3.0MB
SHA256 66848fff1e06b1ad7198cc49cdcdf747d3ec56c7fed779cfd6c0b77a35fd4ede
MD5 95d049d6dbb38fb7706a048f9334bdb7
SHA1 8ae871324915dd5beab6ad7892e69374625cd036
SHA512 0f2940e9cbcb06e8f7279d3d187ef8dd08efb4209b38610b5411ac30eab576a5753f2858a76fdea39041e48b15545e111a435616249097db7a4e3fd6387fbf61
SSDEEP 49152:A3k03kHRJD8tDZqrKWeW4SkZP4sz9MbBPji0Aj:A3k03kHRZvfkZcRjo
TLSH
T1A2E54B16F6B843A2D07BC079C6D6966AFA7334410B7086CB0385D33D2F276D19A7A736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
Size 2.5MB
SHA256 b1d82f75aa25b445631ebb48a7fb69adf42962f32cd377061379352b8a6278dc
MD5 21f655c950e0b59b157600600fe48fe0
SHA1 0957cd52f940cf8615cbe81a497d8a2db17b3a65
SHA512 13fad07f5e023ea78ff0f6f626513256dfd53b1428b304486dbecbec55a9c29b624d75c6ebcc72a41649f38f24da8ec8ffaaec8fd012458f6dc43cdf3ce8b7a9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOai45EWTQz3N+tCn50ChWdArKa1Ze0p4N:A3k03kHRJD8tDZqrKWeW4SkZP4sz9Mba
TLSH
T118C55B16F6B843A2D07AC075C7D69A76FA7338450BB086CB0384D33D2F276D19A79726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
Size 2.5MB
SHA256 8f972051b67e5ac63d2192fc42278e1ff0a75eaf113701f275c8a9281be3c0a1
MD5 3028f8f5c19b363fc8889ae7ba0cc02b
SHA1 c3c42942314412d01dcaa8d6bbab5c3834f19efd
SHA512 fa2f2118fa7d5c66a6e3b6fb1faff4ad24e1d2c00446951a6f525247c55fd50cd805602b5638a2ce0c586224b11e933c616e36040ee4c16c633f4cd946b3e91b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOai45EWTQz3N+tCn50ChWdArKa1Ze0p46:A3k03kHRJD8tDZqrKWeW4SkZP4sz9Mbh
TLSH
T122C55B16F6B843A2D07AC075C7D69A76FA7338450BB086CB0384D33D2F276D19A79726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe
Size 2.5MB
SHA256 0e361a518959a4e87b29781683df8b7327aec4537d9ba16bcdb943dc9c54e479
MD5 fb296ae78f00da0d61e2ba6f25a3478e
SHA1 f03b3f8e314de72e8a587d36bb746583800075a6
SHA512 b1f84813e39fc61326b266607e1cf3ccf8a3cb7379308aa59fe1d40a5579abf378902ce1edd13c34880ed7312d18326f24f5a0acc7a255158d3879b46f7f348d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOai45EWTQz3N+tCn50ChWdArKa1Ze0p4I:A3k03kHRJD8tDZqrKWeW4SkZP4sz9Mbj
TLSH
T1A4C53A16F6B843A2D06AC075C7D69A66FA733C410B7086CB0394E33D2F376D19A79726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3344-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4380-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4380-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads