2a4f29187c1bfd8eba858f93dc747a5366d47ed05ecf1d2c2764c2d79ab5d0b4

Analysis

max time kernel
106s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Size 2.2MB
Sample260718-b7cmcact3m
SHA256 2a4f29187c1bfd8eba858f93dc747a5366d47ed05ecf1d2c2764c2d79ab5d0b4
MD5 de7fd011c5231801d6db950cb5bd64f4
SHA1 4560de23d08f5f9035f716639c7f3515603f53a1
SHA512 89f2935b7cef1c1aada521154e35f1fbdfb04a7d03b4dcb4edfc3eebfdb122464e97df7eee7e5dc18f7f67d7cb4da9f162a185287d2ebb4f736211b15e20949e
SSDEEP 24576:A3mnXoZjzyacNVEuzyUD5Tvinrm5wz6GXg3mnXoZjzyacNVEuzyUD5Tvinrm5wz4:A3kMuX56ry3kMuX56rXI1e56rX
TLSH
T185B56A07A6941FE9D11F813489924662E7737C225F6087DF1364AE263F327C0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 7 IoCs

resource	yara_rule
behavioral2/memory/4124-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5b5-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2bc-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4124-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4376-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-303.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018918-1531.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c5b5-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2bc-11.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-303.dat	aspack_v212_v242
behavioral2/files/0x0013000000018918-1531.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4376	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{DAE0785A-A0D2-4C59-964C-79D844ED93C1}\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4124	2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
4376	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_de7fd011c5231801d6db950cb5bd64f4_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4124

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 2.2MB
SHA256 2a4f29187c1bfd8eba858f93dc747a5366d47ed05ecf1d2c2764c2d79ab5d0b4
MD5 de7fd011c5231801d6db950cb5bd64f4
SHA1 4560de23d08f5f9035f716639c7f3515603f53a1
SHA512 89f2935b7cef1c1aada521154e35f1fbdfb04a7d03b4dcb4edfc3eebfdb122464e97df7eee7e5dc18f7f67d7cb4da9f162a185287d2ebb4f736211b15e20949e
SSDEEP 24576:A3mnXoZjzyacNVEuzyUD5Tvinrm5wz6GXg3mnXoZjzyacNVEuzyUD5Tvinrm5wz4:A3kMuX56ry3kMuX56rXI1e56rX
TLSH
T185B56A07A6941FE9D11F813489924662E7737C225F6087DF1364AE263F327C0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe$

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$
Size 2.7MB
SHA256 64c610ac3dae246cee3fc67dc210bb2c14d732bedeaf6b83db16132858491ead
MD5 8418e31e9aa27ab095f859bdcbbfe310
SHA1 b55661e068a1ae388b332292a79d3b36a0787d64
SHA512 cc3610d7d52828ae0944c99923a3a38939aaa3cffcf43b929e4eeab725dbe7dad38f933ebf9f36d748c1e9f5657ae84324f0d7474c7776a36a67c65d6c682802
SSDEEP 24576:A3mnXoZjzyacNVEuzyUD5Tvinrm5wz6GXg3mnXoZjzyacNVEuzyUD5Tvinrm5wzC:A3kMuX56ry3kMuX56rXI1e56rOT9t2
TLSH
T19AD57B03A6940FE9D12F813489924662E7737C624F6097DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 2.8MB
SHA256 8b0322ad97abe73f17ebdbb750041209104c2a63c06f2c79ebd0a5743157fc33
MD5 12bbbe36c9f93463443c763bd344f872
SHA1 9519f06d9134f427fd4c94dfabd14a6440ba20e5
SHA512 7e7c14e86533ae5518162854076d850f1e46a7ec3d33ed95a36106bf7885383f03d0a80f42a6ac45e355138254759ca41ac9bba6ac66e307451bcaceb7069a35
SSDEEP 49152:A3kMuX56ry3kMuX56rXI1e56rTPji0Aj:A3kMu4ry3kMu4rXI1rrLjo
TLSH
T155D55916A6A44FA5D02F8174C9924666EB733C125F2087CF1354AE293F337D1AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 2.3MB
SHA256 3c1114551f0edf75ca6bb5da0b29edf6ab21a76fef1cb94d599768532be623e3
MD5 fe87fdae745d799af4061db4d341e9c5
SHA1 c0d32f55e5b44d92cee27cd3e87b857054fded8e
SHA512 a16bcfe7e979cf8d9285ef3c38c37d48826f2a81a36a71f9cf025abb950d268364dffc0dc8b8e2288748cd8732a5aa81dce63b4aaa6d2f73961522914bba884c
SSDEEP 24576:A3mnXoZjzyacNVEuzyUD5Tvinrm5wz6GXg3mnXoZjzyacNVEuzyUD5Tvinrm5wz7:A3kMuX56ry3kMuX56rXI1e56rG
TLSH
T1FDB56A07A6941FE9D11F813489924662E7737C225F6087DF1364AE263F327C0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4124-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4124-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4376-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads