Analysis
- max time kernel
99s - max time network
100s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 18:42
Behavioral task
behavioral1
Sample
2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe
- Size 2.1MB
- Sample260715-xcpt3sb13p
- SHA256 a0c10ab15cb5f721ca68872c620be91b48ff753e1453da872863d613da17d351
- MD5 5a87c3c961d4cd619094779f047a5be1
- SHA1 3b759ac590c513ec7aedd0beed3bb300fc30f79c
- SHA512 c9bd4f93be664037e03177750a1d83627955ce9db91cadf338e913a0675a9bf495ba4c83fb858e4bbc4658b2e851bb5dfc5d9579d8968c122805b1c2e72a5d31
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaoEavr1Ze0p4Ek4niOkl/A04szE87JKZ:A3k03kHRJ7eW4SkZP4sz9Mb1
- TLSH T1C5A51906F6684272D06A8075C696A65DFA333C4187624ECB1284FFBC7FB36D09A75336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/1096-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c5b6-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2a3-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1096-165-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2216-166-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-353.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b6d-684.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b78-681.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c000000019b15-753.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0029000000019cc8-1221.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b676-1899.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c5b6-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2a3-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-353.dat aspack_v212_v242 behavioral2/files/0x0003000000019b6d-684.dat aspack_v212_v242 behavioral2/files/0x0003000000019b78-681.dat aspack_v212_v242 behavioral2/files/0x000c000000019b15-753.dat aspack_v212_v242 behavioral2/files/0x0029000000019cc8-1221.dat aspack_v212_v242 behavioral2/files/0x000300000001b676-1899.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2216 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaw.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe - Drops file in Windows directory 26 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1096 2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe 2216 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_5a87c3c961d4cd619094779f047a5be1_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1096
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2216
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.1MB
- SHA256 a0c10ab15cb5f721ca68872c620be91b48ff753e1453da872863d613da17d351
- MD5 5a87c3c961d4cd619094779f047a5be1
- SHA1 3b759ac590c513ec7aedd0beed3bb300fc30f79c
- SHA512 c9bd4f93be664037e03177750a1d83627955ce9db91cadf338e913a0675a9bf495ba4c83fb858e4bbc4658b2e851bb5dfc5d9579d8968c122805b1c2e72a5d31
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaoEavr1Ze0p4Ek4niOkl/A04szE87JKZ:A3k03kHRJ7eW4SkZP4sz9Mb1
- TLSH T1C5A51906F6684272D06A8075C696A65DFA333C4187624ECB1284FFBC7FB36D09A75336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$
- Size 2.3MB
- SHA256 baf9e0bef725422ddd80119468481312009511408ca3d04694003a9b6acda00c
- MD5 3e7c626633b6570d48067417692f1b65
- SHA1 a85467b02a0de24e0a6a02097504447c4f6aeacf
- SHA512 972d4bbd762e1815069bb925cb2177016f2e8f2a396b616a5ccb40328c0d2d4020a9795d1362505eef7d200990c8c4ef4c78a96d029f503ff21d32243e2890d0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaoEavr1Ze0p4Ek4niOkl/A04szE87JKc:A3k03kHRJ7eW4SkZP4sz9Mb4lNtqna
- TLSH T106B51B06F6B44272D0BA8075C6965A5DFA333C4187628EDB0284EBBC7FB26D09975337
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.7MB
- SHA256 e16beb3035d29687c04c6fdba68228dd5162f343dbd10fd80eca53660f7f2732
- MD5 d3623ef09454e7aa4a730679b11914ce
- SHA1 a5ba025a8d4ecf2c67480deab9da4fcccd72a280
- SHA512 f659d6492afc9d7ef2095edab33b1196dc24c8ac3d871ddd62b887f4c5f422c929ab2e72967b358fdfe4c673a9c51798a17dcbeecdc743ab2c7472f9be70f2e4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaoEavr1Ze0p4Ek4niOkl/A04szE87JKR:A3k03kHRJ7eW4SkZP4sz9MbxPji0Aj
- TLSH T1B4D51816F6684372D066C075C6D2A65DFA32384187728ECB0285EBBC7FB36D18A75336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe$
- Size 2.1MB
- SHA256 d1484362144da22cbff46acf2eaf76668f3f8b2d80942d112b9d729b949a3e21
- MD5 1eabdad6ceeb6359c774823ce0d0a8ee
- SHA1 a7f268d300d97a28b1dc35a19a6b1d93f5f7474c
- SHA512 f65a51abeffe72b60d690f0e4d78f9785efa147e98e733486d51fc24ae9f01f0d954772bfc9d81d44817298060ac8e3e8089434ab57e2cf420f5efc7c3f33c41
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaoEavr1Ze0p4Ek4niOkl/A04szE87JK3:A3k03kHRJ7eW4SkZP4sz9MbT
- TLSH T1A5A51906F5684272D06A8075C696A65DFA333C4187628ECB1284FFBC7FB36D09A75336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmid.exe
- Size 2.1MB
- SHA256 32123833c15be0dd624e03cbf823f74107acd3e30809608fc2ecf5886264536f
- MD5 14093c9f6bce57b65caa2548c33a2a8f
- SHA1 eb654695d4e10b024936944f07ba8fc9d489a4d9
- SHA512 28a19148cf4b59ea20914213c757ebe92e39723cee60008dd31d92e3ca7251dfcf76f78fcbf9cdd25b6b3fa8977eb81b7cfac682135bcc33d1ac4f0665a558e9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaoEavr1Ze0p4Ek4niOkl/A04szE87JKi:A3k03kHRJ7eW4SkZP4sz9Mbm
- TLSH T1DFA51906F5684272D06A8075C696A65DFA333C4187628ECB1284FFBC7FB36D09A75336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmid.exe$
- Size 2.1MB
- SHA256 89bc634984d6ca03b2613a4faab160ba90399305ddb37649205e514688d565d4
- MD5 1361255131886afe91c37dce919e29d8
- SHA1 baf88c9b2641a2bf52856e92a0d26ef7a712fd85
- SHA512 3feace14de806b20f92485fc46081faf3d2da37a35c03598a4bfdc7c82026894c4b5ad810df0bbe54f46757fdd7c0824ba1ed6c95133c8594054301ec7d129b9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaoEavr1Ze0p4Ek4niOkl/A04szE87JK3:A3k03kHRJ7eW4SkZP4sz9MbD
- TLSH T15DA51906F5684272D06A8075C696A65DFA333C4187628ECB1284FFBC7FB36D09A75336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 2.6MB
- SHA256 ea9cb95ca79eed8749b8628dc1afac6f5aaf8f1bbf94618e0e98060b5abd097e
- MD5 01d9513a7389f5a96adbc548671f8370
- SHA1 dae1495a59b9b190e3bb6b99a3578bea2559a204
- SHA512 d69fbf57e8d8df1f66d368eabb5a14e77f119e66b6b72f27aed7bac282c581f117777e9acb16574244a5601834fde5874d84f6113c0957e56fca343bdebe8819
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaoEavr1Ze0p4Ek4niOkl/A04szE87JKR:A3k03kHRJ7eW4SkZP4sz9MbNUOlk09
- TLSH T14EC53B16F56842B2C06A8074C796964DFA333C4187628ECB1284EBBD7FB36D09E75736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe
- Size 2.6MB
- SHA256 16c420f654b3c08e32bac9029781e033110215cea4751aa0b6110a7eb9ac3369
- MD5 0172a792ab6eafd972e0f20385f5597a
- SHA1 da6fefdefb2192cd1ed051f87ad32c6d69ef2338
- SHA512 0ea8723434bd4199e6fbca24a9c9b594c5c26977a0d35c084c9dca2429045e9198e62447178f017251061129bfdf91a0f90b3f65d2dfbb2b67598bdae3ea4490
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaoEavr1Ze0p4Ek4niOkl/A04szE87JK7:A3k03kHRJ7eW4SkZP4sz9MbTi6
- TLSH T173C5D542E7658E72F0698074C682562DB6333D0987E34DC7128DBFADAFB268459F4336
- MD5 SHA1 SHA512 SSDEEP TLSH