3b07cada3bdff6a0793330a9925b3a67eae1652dba10f0adafb651d25763d043

Analysis

max time kernel
111s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_2f18e649977b1638d06ee3e518f88e52_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 934KB
Sample260715-rsagfaew2j
SHA256 3b07cada3bdff6a0793330a9925b3a67eae1652dba10f0adafb651d25763d043
MD5 2f18e649977b1638d06ee3e518f88e52
SHA1 3667ad19cf512dfd3d371c36e2d75874559404e8
SHA512 804edfa2179b38fbc9872d52186e7a0891db9f5d08731a4e35eaf5c6867c8ff0db8d2d2231c901a00def0a4a5b4af8a610f6ad38cfbf706b33679dbb8e5b41b4
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPu:t/sCv7rTiw2RYwZCUsjKpJshPu
TLSH
T15D153A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/3644-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c4f7-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3644-15-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/940-22-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001898b-202.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a65-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-481.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-506.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-603.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-628.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-719.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-745.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-795.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-844.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-908.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-953.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1003.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1046.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1083.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1132.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1151.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1292.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1330.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1356.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1405.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1406.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 42 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c4f7-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x000400000001898b-202.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a65-257.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-366.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-481.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-506.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-603.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-628.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-719.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-745.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-795.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-844.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-869.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-908.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-953.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1003.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1046.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1083.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1132.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1151.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1176.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1183.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1292.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1330.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1356.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1375.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1382.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1403.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1404.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1405.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1406.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
940	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-15_2f18e649977b1638d06ee3e518f88e52_cobalt-strike_conti_elex_hijackloader_vidar.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_2f18e649977b1638d06ee3e518f88e52_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-15_2f18e649977b1638d06ee3e518f88e52_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-07-15_2f18e649977b1638d06ee3e518f88e52_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-15_2f18e649977b1638d06ee3e518f88e52_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-15_2f18e649977b1638d06ee3e518f88e52_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	2026-07-15_2f18e649977b1638d06ee3e518f88e52_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-15_2f18e649977b1638d06ee3e518f88e52_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-15_2f18e649977b1638d06ee3e518f88e52_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-15_2f18e649977b1638d06ee3e518f88e52_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-15_2f18e649977b1638d06ee3e518f88e52_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_2f18e649977b1638d06ee3e518f88e52_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_2f18e649977b1638d06ee3e518f88e52_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3644	2026-07-15_2f18e649977b1638d06ee3e518f88e52_cobalt-strike_conti_elex_hijackloader_vidar.exe
940	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_2f18e649977b1638d06ee3e518f88e52_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_2f18e649977b1638d06ee3e518f88e52_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3644

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 934KB
SHA256 3b07cada3bdff6a0793330a9925b3a67eae1652dba10f0adafb651d25763d043
MD5 2f18e649977b1638d06ee3e518f88e52
SHA1 3667ad19cf512dfd3d371c36e2d75874559404e8
SHA512 804edfa2179b38fbc9872d52186e7a0891db9f5d08731a4e35eaf5c6867c8ff0db8d2d2231c901a00def0a4a5b4af8a610f6ad38cfbf706b33679dbb8e5b41b4
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPu:t/sCv7rTiw2RYwZCUsjKpJshPu
TLSH
T15D153A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 fe773fc5cea55c61aa41b2663b422d3e0ecd66954013c1de2a47ee7569c38d29
MD5 43db59c3506bd442aac03ffab38eae8b
SHA1 894135fc852212dad35c7ccf6a331314971fec16
SHA512 dfbecb7f34ed282126e2a9ad6b1fe2070c5e0b0398400c307bb6ccb2272db9961d5e1ece7506ea6994da06b715c71941f358a7fc8e9c71dd9ff28f0fb8bc96c2
SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKpJshPe0Le5ji0hmxNrM:x7iw2jPji0Aj
TLSH
T1C4654A17B6A84661E073D174C5E6864AEA72B4461B3087CF1268C73C2F63BF1AE39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 949KB
SHA256 17923b6dc34f88a7f52dbc93360d55c6ce58799fd3c3bacfd3372b3e2e6d443e
MD5 bdaf0a3bb29a98a215a0f4ab97a92050
SHA1 b75842131ea74e43e07860aea0a6a0aab48da507
SHA512 47ced50ffc855ab4259491c1f06e9b335c5d8aa5d33897562250b93087aa64bbd960abf0c0ba4f878012696c1d2270ead5dea28491f0272b7706c32ade914dbd
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPYa:t/sCv7rTiw2RYwZCUsjKpJshPYa
TLSH
T1C6253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 958KB
SHA256 a8341be886f71daef2d3590266d2d2ddf0d4e514577560a8ee848ada87f71c19
MD5 d8755c65e1dc5a9e4548238540e13076
SHA1 6ba8b2ae07f75b8b765d104c87b2b8e8fa5be6c5
SHA512 0d85385b23d74625aafc38eb32067817962208533eb4d3e55457f7abac959f89de40a6ad4e8ed4a05dd1ff38f13876a0d19fca398121d499356c76ab6cf59ff2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshP6Z:t/sCv7rTiw2RYwZCUsjKpJshP6Z
TLSH
T184253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 958KB
SHA256 ab56bebfe718c1fc376e3271e336760e4dca725f55015a97259cf2fd665d6a36
MD5 82c1a7522eb39060ad965043bc23f6ae
SHA1 9a3760b48c930476c95b7cc8880e5f96b15df2c1
SHA512 861717739c696fa421137f8d09a115cb051c186e036631e8aabc1863134eba79f117695610241c170cb4177a6f0122f22e1ec6f6ba9b95d0a783ae33070de354
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPF1:t/sCv7rTiw2RYwZCUsjKpJshPF1
TLSH
T128253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 958KB
SHA256 a387797d021ceebce5116b7b1c6e1ca94f69eb80255d4b342308ae87a7ff9f04
MD5 594641555ff67d1f2b89194d4b8199d7
SHA1 b2fd359f034c3f1773ab8b349c2275a36180e7ec
SHA512 355d39524b57657d0ee95dd43b8e75aaff25bd3c0c4645bbde5f19c567c181691c7b734da4914b08333a2ed41dd4f531b895247a27fca7f77581c1d2a9b9355e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPx6:t/sCv7rTiw2RYwZCUsjKpJshPx6
TLSH
T106253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 958KB
SHA256 5b5d8f3a5b6550dfd1099bd85ad27c125f7cf7e6711ca4cec023659c6d0235f7
MD5 e154b228838f8f67b5ac37d152509bf1
SHA1 1dff7d4c1e734ac4ff812deab7742b94b505e96e
SHA512 c7c1d1d741277d693eeef840cb286931f3358b7fd33d889a65c38e2b82999c14af32d4453658325360dd38bbeb4f8618adf7b2235518f93c2886280932759c6c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPvN:t/sCv7rTiw2RYwZCUsjKpJshPvN
TLSH
T137253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 958KB
SHA256 f80fc67c05acc3eefb3972c8a2db799530f92d5ec5bfbaa439a0d9163295c28e
MD5 6483a495c93f50aa321ac7ae4aaf5558
SHA1 d6443a1c0350b0d454463ee8ef124b8d8590f95c
SHA512 59c1cdfc59c27f0273252f4de5cc7341f4ca08e4d18044259bc13f6c9c779f90dc425b647cf810a7c0d6a85ae1ed91f02f4f0020ef27db41d75507cee66a2691
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPVf:t/sCv7rTiw2RYwZCUsjKpJshPVf
TLSH
T1C7253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 958KB
SHA256 de9b3671aa4884b2a8e22ba60f583ec8ef20b0b9f553da7ad0a472cc557cd906
MD5 9ff3701aff80ed3315f70dc15d9a00c7
SHA1 e24030ac6036689e7239e6e4fbf968a814d1c15f
SHA512 4c9ea7b8ab8c2d4feebbabbaa031420daab70ffc1d4dd89474f00375d2ad26f59d356fb561af7f115aa2c3f1359fc1f8c06aefe4db67a5024f9d090ccf42af63
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPXo:t/sCv7rTiw2RYwZCUsjKpJshPXo
TLSH
T153253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 958KB
SHA256 a0e469dc9e01b0d6506524ed78a5fe4d24c34a934fd42a79b05cda52c7197cf9
MD5 ef488d7677cf9e942dabfe0c0bdefeb3
SHA1 fce8ca046182b41c51316117a958cdd89c005917
SHA512 ef4f961b43f37147f9dff84ced86f7f68ffdb37d0450b6c8811cb6d97144916b6a8d5939ea6ffac55cd1ec6634d1cd52666d0fa80c71e6cd1cf4b02012ab5c4c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPbu:t/sCv7rTiw2RYwZCUsjKpJshPbu
TLSH
T11B253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 958KB
SHA256 8fe38f6f536249d7e59960b247edcdc1cf31d4eb48d06ace17f88778eabbca34
MD5 0913f7589f623dccc9478be592819a10
SHA1 3e72a9b76f66c742d9bc73e91f9e2c2c0d18d997
SHA512 2f9692276afb3d76857dd251c16709b7785ae3efb24261f4e111f52813d65b95bcf5e80e44dc3275fef37955253ded5d33316f683d0d7a7f75cdbbff1cc4dee9
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPJ9:t/sCv7rTiw2RYwZCUsjKpJshPJ9
TLSH
T107253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 958KB
SHA256 29f09a1fdcc65c7fdcd10e83f710ac03c499d31a6c70cc17a9b6dc2d42741621
MD5 b0f466f2d60c9702484b40f829d89d42
SHA1 8e8142554642be58b6e3e3c08c1fd8672a415c03
SHA512 4366f85f59301697cf7635bb42b5a42814a973a2feac8d3dd6e45d5283bb8d37930f9fcc6cd260d16ad4bcf140d3dd479f2b5ec06116b6b003b23fd58676d495
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPlc:t/sCv7rTiw2RYwZCUsjKpJshPlc
TLSH
T182253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 958KB
SHA256 ecf5ebc977efd2b35640da1e4ff330ca257b493bd0626c4a6ccc3285f83bb902
MD5 daae2719dc45c8bdcc5a83c34626c26a
SHA1 36b68056896016ca790356d53e017666034a3863
SHA512 5b065bfb3c3a27f86f01adad927ae142a0d876ccfb46ea724790219633df591ae4ff5a73d556b76f877b4891d6b0c60f5bab18c8df5ca4b38f0d481dd8ac83dd
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPep:t/sCv7rTiw2RYwZCUsjKpJshPep
TLSH
T15F253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 958KB
SHA256 7d8fafed23f695e2c0e4af2511fe58eeb8615c1971b5ff48232b66eaffa7e0db
MD5 3f6fe019c388812be2069993a5901a05
SHA1 5ee6eb71ce8a297cc55b287afffe4aaccb4a029f
SHA512 5b354ce18f265e91306f88e1892838922e25040026796871befabda9524a24699dd4867b479e045160037bbaf4477b55689a2be2e9881d8e016af94660864204
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPR0a:t/sCv7rTiw2RYwZCUsjKpJshPRN
TLSH
T114253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 958KB
SHA256 635a480e81d0e055bbc0b07bb4c15042b6b085230b3af4cfee668360a3369c4d
MD5 4b24920025cb59e469e90eade4472285
SHA1 85f9ca7a87b1a487af1215ff348deb5be07e1f0d
SHA512 15898a78166756dfe8b2dde6b2f8904c5ec066582bbffb222df37fb46b568a8c38ed6a5dc6e0668b4cfedcdc09499b0ae4ca80c6e711f2dc794f761c702edd68
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPzF:t/sCv7rTiw2RYwZCUsjKpJshPzF
TLSH
T1F4253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 958KB
SHA256 3e30c2b37e28373e4169e0fa0fbb147ef9f65df90c7d459fc822e28f5b349946
MD5 f2d54f988b72a799d55be786095c5251
SHA1 72c36352d926e53b5c041084e52d99e97878b29d
SHA512 25e6c090b78e3799a9db6615f0d397d584f93596f334a350c1831961e858ee720abdcf9f80d250149faa15c6ebf27e8ba87f67ecc0bfdab143699616b1e254ef
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPcC:t/sCv7rTiw2RYwZCUsjKpJshPcC
TLSH
T1B7253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 958KB
SHA256 e5568ce9c73845e705e42de7c25310daa859c3ecf82e6459d3daa080a1e880a6
MD5 ef1dc3523a316eadbcbb5191c45fcee5
SHA1 84152824948a2f1e7058534cb17475c57d16b5f6
SHA512 a10a4e5f6ad660ed54cafc6fdc8d239828325c35f11c6f4fcdf383b59a052336ae93aa16ea861f2d3adb7a2d3727899ca02a112da2b872de89795f4a4fb540a0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshP3w:t/sCv7rTiw2RYwZCUsjKpJshP3w
TLSH
T185253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 958KB
SHA256 256d562f305b9e03e4d988fe8d20166d4cc725cd0b3633db96e0584457d3bcc0
MD5 cec288f2637957ca1ba21103f3ff8086
SHA1 cb179c7d35601018b68416840f47a72269d445c0
SHA512 b528fad4e355735b377608adfc8ff550f9d72f226a7a9354555bd64c542b82289df15dbba5cb7200f7815cf9913fd2ad34209405d9c954528907546572d80120
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPmT:t/sCv7rTiw2RYwZCUsjKpJshPmT
TLSH
T105253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 958KB
SHA256 c5b39fa92d4f960d9c8fb977cd330079b3e40433baa75dadf7c8eed1313995a0
MD5 6be108065e0af3065d2e63e88c26b13c
SHA1 d45f2b043e21959df4fab3ab39dbe551f7f0cee0
SHA512 636b14419f93c97718fe5c6bac44aff3a47567d57fc1dfa41ea89b0646f17f4339721d0300b74102446da06499525da538962ec4823ab18b4df77c231fb95b44
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPeu:t/sCv7rTiw2RYwZCUsjKpJshPeu
TLSH
T114253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 958KB
SHA256 d055d75dfd3f630341f0c021283c3d53a0cb66bea0ff393dd544070487519651
MD5 cb9dcc1abfec9817c9182e9661356877
SHA1 b0e17f9f5b3ed0b96116b3da8f9af96cdeccfb4f
SHA512 a37b6c12339b49d95e288c5537515783dbb9c03aa6b248bf81e48d4c72aba41f518e88a18dbd602d8a2bb7f1e684b0a3971f93c2bd22445beed16eb45ef700f4
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPYb:t/sCv7rTiw2RYwZCUsjKpJshPYb
TLSH
T104253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 958KB
SHA256 034c95bdac7ed4342a2382056f5c6a7a3c3aadc2173a5d3f0a6531db5f97b748
MD5 5d1938f7517c0e427fdb12fb8ddb7ac8
SHA1 a31c4cb575e5b1c0c8f1c2902f33cd69b853fd81
SHA512 dc6bfd60e2663a8e8a115aab90397dcdbef1aa54773be2fc899fb5433ee2be8283608e5cab93c0e0216b88da402702f7f38d2be19aaa997db480a318db2e5182
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPGf:t/sCv7rTiw2RYwZCUsjKpJshPGf
TLSH
T103253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 958KB
SHA256 ec7f93cb4fc0f9c57c7cca41181923c62be6edd3c135f7f43bacd9b73e918790
MD5 3e017255a778845518aab3ec1c3b66b4
SHA1 478eeb050cb33e038fae74f4d964b4f63ca74057
SHA512 054deebaf8cf5c9aaff2148e441b7e991a81a3f752a787a7d52d36d23eedb74a59f647acc233bda11a31634f9e06efda12e25d77c6605d4830abf000d381d63c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPDK:t/sCv7rTiw2RYwZCUsjKpJshPDK
TLSH
T159253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 958KB
SHA256 30d8aa570444c9bb79406467d24541f0a8f85f91c4f4ef906dd845cbed740f0f
MD5 367f0ca9b722090000a36aa77d074daa
SHA1 1286769fd65706d21d8e91efbdd29f884ce85baa
SHA512 3f1823c59dff18d95ae31b39937ef5053dab300788c34b7d303754d37c4e9f7c58e99db1887092868eb2a133056825074be0dcfcae31eaf8178196a4ff8fa396
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPkk:t/sCv7rTiw2RYwZCUsjKpJshPkk
TLSH
T106253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 958KB
SHA256 701379bb4237b91217e4fc659c073716c3c2ceaf45a6f077b8c526ad8260eaa5
MD5 b2308fdf4549cdd8875aad1ca97ab41c
SHA1 0591e0ea285c03cb3a0e3d69bd5a1b0182fad5de
SHA512 38f657614a34cb322398087c30c62f55b018aa4afae5e67aa2206856e3661d003fb6630f90249b17e20d6c2e35fb5f3b2b5e0f622cb026e9602a01e53922961e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPt0:t/sCv7rTiw2RYwZCUsjKpJshPt0
TLSH
T10B253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 958KB
SHA256 dc66ceec178135e5c49700c9275090270721073dc1326ce6ebe6133bc9c6904c
MD5 20c74102a5633beb8439ec0db7ff3b66
SHA1 d366f97070f5bbd4db41849cae967aec384cf877
SHA512 a3649affead747d0463eaa329f8019016d5d1007166846f62aef913b048c1e478d00ec7ed21fc9f6f98a837741cf6b055b82b7f44d2231bebccb0fdc27cb6eba
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPw70:t/sCv7rTiw2RYwZCUsjKpJshPwg
TLSH
T176253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 958KB
SHA256 b6d1757252108b9b719d66bf7722d44e08c00c8e958dbe5966cab328a1022f1a
MD5 5c203b27bc7419b659fa4f083d65ee08
SHA1 4baef874f99f18e8b26771efdc6f9810ff662e8b
SHA512 c9d35e1a1084e48064cac9dd1f58615d03b95d9c2e7eec76c0f8f08cbc68245e4001369c3ee523605f3acfaabccaafcd8a8d93ef8750793d46d9b78bda77949c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPFr:t/sCv7rTiw2RYwZCUsjKpJshPFr
TLSH
T15D253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 958KB
SHA256 aef989b33d56c76ae8d20ba1f74221e88be902ca81fdc1de4dc2dc9ebab3cbd0
MD5 9c86e0b3f0fff30d3a47d16b2a565602
SHA1 1da3271f93ef222c9233950b8275e089459a6440
SHA512 829352490aae263fcdc78d7a79b37626a1e5e318d6a85b02b0bdeed8a1386a096cf159beef83e9609ef4451d05e5747fb1f8466fa8cf102c6d0c9fae54dfac85
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPPn:t/sCv7rTiw2RYwZCUsjKpJshPPn
TLSH
T192253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 958KB
SHA256 3b5af404fdc695efe358587f52710b3597453274393fffdd2bcfae2b97252d48
MD5 4c8d41422a2fd515e75dc0254009b34b
SHA1 64207b62701fa3ae2bc2be163bbc203e16e04f95
SHA512 57ca5d954f6dcf664ca54ad22293e63400ea4a03dfcb63e62a030f8b51a0df10588533bff337a4b9ca079a79b9209495dbf58c469663cbcd5074fd39a032dbf8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshP7x:t/sCv7rTiw2RYwZCUsjKpJshP7x
TLSH
T11B253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 958KB
SHA256 d889c5081eb415d78e9b6c7acb3facb21050d8cdd4bcee59c7a9a00b826c0a94
MD5 062fb055c788f514d310dd6b5ee494e6
SHA1 fe1a5ade12947d46899b406054f5501280dcd2b7
SHA512 3487af2f705fba1349ea6f81d4989ba9b4563445fcc296420589b5d455d72449810b8e76cdad041eecbbbdaca6b7bdb63bc42f06842c9e51248d4b6cb7a13887
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPpA:t/sCv7rTiw2RYwZCUsjKpJshPpA
TLSH
T13A253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 958KB
SHA256 17fd338e1b6f360e5f4f7e8e70636449b425c70731ebcca40d74ff1b8f866819
MD5 63c33499c9c153b230e7449692dee09d
SHA1 80e942a98fe21c35a21614a7e42a43e2546825d0
SHA512 f127d0c98cec53f9d4686b94acebdb2d44261eeee41bbfe8e826dcd62f8678036e755c1673ca41be9673ef4ef61c8592e3797d4de2cf51354d6a85c78fda749c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPi9Q:t/sCv7rTiw2RYwZCUsjKpJshPi9Q
TLSH
T145253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 958KB
SHA256 6493c4a1a3b3ab506dd264c4b490e1efbef6c5c424d8b559f9cac1e31d3bbe61
MD5 2bb182939d50b0081205c71a1c8f5d71
SHA1 254960c6139681fd693d0f9f093fa2ce71e174b6
SHA512 aa6437cff51fb5925437b659320817b5583db06adcea12c8b0f0a286bab83b54a886cbd61fd8c84cb5d66c1641d73c9640ed0d2ca3fafde246c66aabc7a77ae8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPH4:t/sCv7rTiw2RYwZCUsjKpJshPH4
TLSH
T1F8253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 958KB
SHA256 e2f9cc9cd795779bfea4a3f21fc07271cb475f67e62df92df6abe7993bd1a470
MD5 6e262e45b1a2fcc54693f4ebf9577ada
SHA1 0d61151f51f404a54c9e7360315a066505250e3a
SHA512 59200dab3255bd6196e5597bbbaaccac752795c59a21fc1e6d4f0dee137dbab4085518eb8a4195a205cb29cff30dae6369fe5d71191fa0058051d63ef098b36a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPmu:t/sCv7rTiw2RYwZCUsjKpJshPmu
TLSH
T13B253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 958KB
SHA256 e167a09786be1fbc580e883e8fe84b44577501a0fdd30c7461bee33e363928d0
MD5 d09967db50f362d5d66da8422bc4a0fb
SHA1 cb08319e3f6e1b41fa09b1c2119c80774d69ffe0
SHA512 48a6658ac8940d4bdc58c89a49da5fd93914917b93389520fe6625108fef2eae61c4d621bd87ab929402df4af180adfd37437f9335beb3fe022d56338a50d8cc
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPXj:t/sCv7rTiw2RYwZCUsjKpJshPXj
TLSH
T1DE253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 958KB
SHA256 406fad95a66491631cab25c7f02cd59e8895da33b9a139e544cb8c4a93b4df17
MD5 de1f50037d82ed1ab89148898ce01070
SHA1 a8e415c19501c82544a34b738439bed02d0d77ce
SHA512 27a06ef74002af606e3bb2602baa414415e6ae6da49751862cbc9bbf4bb70f7d3c251614592be4531eda979c8212653dc3ad5fc8ac0e98f0cc67251eb5f77be9
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPCg:t/sCv7rTiw2RYwZCUsjKpJshPCg
TLSH
T1BD253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 958KB
SHA256 ae0f494f611e217a20b57f648ace2d071c723bbcc924361b138f17f29964527d
MD5 6b95baac8574e5a57e0db1e0d5aaa6f6
SHA1 8a3d9a78791756b333624eac55309a99ddb4c529
SHA512 5ea2b3bd2bd481cb576bd0b847517f5941e742af8eafb074e146c973fce21bcf1bbc16c7c8f0a10f79ebc1e31d633e1c8f0ee9dea5df096084163b467578bb0c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshP9I:t/sCv7rTiw2RYwZCUsjKpJshP9I
TLSH
T137253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 958KB
SHA256 dbab83605714b28cb38b9339f3871b122e18da362473f05b7d7de350c48fc05b
MD5 5280c54b33c594052f430fabda5c15f8
SHA1 14acb6422519478fe3d92d94bef3fe40abde0179
SHA512 4c4d5cf1a73ed8499b4d8ac217c14d0995c25ff1c904aba3b015ce9caf4760e1d488629bf04346e0adb9ca96de389ce945eeb78190a645fbfb3017c46306a2dc
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPvo:t/sCv7rTiw2RYwZCUsjKpJshPvo
TLSH
T17D253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 958KB
SHA256 7746a9f2923f0cd0045e3b175706664546b6af6f4ec7b5ed160609668a4bdea5
MD5 116c6e8fb4e849ec38ff5dad4057843f
SHA1 da9e0168432aa1dcfa5195bcc56fc799eb5b8d7a
SHA512 76bc1f3f52836429042330d1710414fe2c344dcd8a23e4d4d5b48c5b16187e8462c23784d6fdbe8bf6e9d7f3431e4602d6cc91a4dfad3ec696165b3f0df7c29f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshP0+:t/sCv7rTiw2RYwZCUsjKpJshP0+
TLSH
T1D3253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 958KB
SHA256 2aaffe4640fefd670aecaf73ab41d7194086e754d1ee1396601d9e2145927217
MD5 adcff57041518da9c70749ffaf84b977
SHA1 999199c78b5667f9e994fbb5b138eba242654b48
SHA512 c19c73150d55e96cf3810495db6d778205deaa8663879338a2944fc0bc28909bc265c25f3583833863988ae3b42139b33c8c528228a324cb6fecc7add97d323b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshP8Q:t/sCv7rTiw2RYwZCUsjKpJshP8Q
TLSH
T198253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 958KB
SHA256 dd4c1680684d3439ddc35b39cc58d2732fa23230b2bba564a8563c0671ea47dc
MD5 2ae8af2365044b59bc9688270c30b456
SHA1 6c23a5fccb57c90b6ccf02ae2f9a389081ddfb81
SHA512 da82f8a8ceec4e79bd1cb204f28d072ca8720c6c2799b93fc63f71322104f2109eb01e70c451cb39e2a6e19febab1948e6b73ce8c1ef25d58ae8d0c366c86cba
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPlX:t/sCv7rTiw2RYwZCUsjKpJshPlX
TLSH
T1B8253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 958KB
SHA256 11d91fdf94ccd8ef8e6a04de77fcc556c6830ff1525aa08cad0fc66088d26137
MD5 967fc173a46493ef917984cabb028218
SHA1 17e9703fca5960333960cfbb63bda3c74b592bde
SHA512 aab5de694cb1c9cb183b562131e545d89d9f00dc470500573f6b73ed1932ebe04fe1fb84c8c7d9f24f6a3c0352d45bb983a1793a19ae53beae6698621a5dc16b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPHL:t/sCv7rTiw2RYwZCUsjKpJshPHL
TLSH
T144253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 958KB
SHA256 9a2d3c24b23618e2bfae7bd82359f982f5325b6969612d6c308f0ed7409f8dc0
MD5 b6b3fd32cf098643702100d1228b20b5
SHA1 713e65bedbc7e0eba27157e19858bb3976a02dc1
SHA512 2fe9c45a1b717a5ae3a2210aea369fe18658196b567446fb7fa23910a52b6ce3d2a941ea06b65b9df59082ea19cef9631b1022f5f319b63e7a45263865e4e38a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshP9FC:t/sCv7rTiw2RYwZCUsjKpJshP9M
TLSH
T17A253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 958KB
SHA256 3d85c1ce1f371c75066cfad5dfa5eb93d6527f29ea6e252333482bfe49715e0b
MD5 9b2e32b10603898ca2ba75382c3118c8
SHA1 3468c962b8e43fc072a95fed94234855230971ea
SHA512 de386f417a39ca5ce8cb11da7b723f403a53be6669a9de764f036fd5d92a24b0df085c328ffff91ad6aa61fa38caa172cebf7d44cda919c6c328dd9aa5a16f51
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshPuh:t/sCv7rTiw2RYwZCUsjKpJshPuh
TLSH
T13C253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/940-22-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3644-15-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3644-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads