1f330e64f42820a95db93af2e0e223e01284c74672de23a3bb16fef3083cdc31

Analysis

max time kernel
105s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 22:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Size 1.1MB
Sample260719-2hzzfset2n
SHA256 1f330e64f42820a95db93af2e0e223e01284c74672de23a3bb16fef3083cdc31
MD5 57b7267ca6530cfcd88a9ce2aa2b80e8
SHA1 bdcf526b0ef858ebb0a868ae3a1bc6e920f433c5
SHA512 535c3e08a5ab7d0134569e95572c7b01032107bea7f42c1111f1f7b99a82dc252fe8ffa73f6236a6acbb168d326a280516e4b0e6ad0106ff579fe72f31417455
SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzywFqw0LezI1H:A3kM456r9/5I1H
TLSH
T151356A17A6941BB9D12F8138C9915662E7737C225F208BCF13509E263F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 7 IoCs

resource	yara_rule
behavioral2/memory/4912-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4b0-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4912-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3916-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000199b8-572.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001ace6-1292.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4b0-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x00030000000199b8-572.dat	aspack_v212_v242
behavioral2/files/0x000300000001ace6-1292.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3916	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4912	2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
3916	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_57b7267ca6530cfcd88a9ce2aa2b80e8_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4912

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 1.1MB
SHA256 1f330e64f42820a95db93af2e0e223e01284c74672de23a3bb16fef3083cdc31
MD5 57b7267ca6530cfcd88a9ce2aa2b80e8
SHA1 bdcf526b0ef858ebb0a868ae3a1bc6e920f433c5
SHA512 535c3e08a5ab7d0134569e95572c7b01032107bea7f42c1111f1f7b99a82dc252fe8ffa73f6236a6acbb168d326a280516e4b0e6ad0106ff579fe72f31417455
SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzywFqw0LezI1H:A3kM456r9/5I1H
TLSH
T151356A17A6941BB9D12F8138C9915662E7737C225F208BCF13509E263F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.6MB
SHA256 f0c02a6229789b4f35742fac6277e3b30ca9a5253037c05c3f1c0df79de914ad
MD5 68ea2232cfa6ba6858019e2440cc08d0
SHA1 eaadc2a1eae9aa3de0ff673eb6fecbd35577ea15
SHA512 abada4f4ea954b42ca0a051ba18b214cebbd3610117d7aec2a815125389dabbe295bc2b9c84f82f8f4b08f803bcb8fdc69cb608d681308ea744f0161344063fc
SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzywFqw0LezI1D0Le5ji0hmxNrM:A3kM456r9/5I1DPji0Aj
TLSH
T189755A16B6A44BB5D06BC178C9D29656EB733C520F308BCB13549F293F237D19A3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
Size 1.1MB
SHA256 04f44f8a92206780ef440308641da099f9f79cecd42f9f26e6bfdb2598014fe3
MD5 dddbea219d68f0d884e83ead8bd6ca51
SHA1 76d7620c9711d8238c86b1c8650e02c02b0301c0
SHA512 039b47257efabbd6790ec63de55bf474038c2a9a99ddba7a7681c980ecbfe6d336bad8ab3335e96ec1859c2719efd43995c2dc70deb80badfcb7a2a22329e648
SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzywFqw0LezI13i:A3kM456r9/5I1y
TLSH
T1D4356A17A6941EB9D12F8138C9915662E7737C225F208BCF13509E263F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe$

Path C:\Program Files\Mozilla Firefox\crashreporter.exe$
Size 1.2MB
SHA256 fab53eb42ffd00f46dd0442455bfb564e73f3cc5df2315b161114472edbc2b62
MD5 4b961660c228ce92ad82db9fda473d78
SHA1 228f5f5ca1e9601d28a72dff59e47559d050ca58
SHA512 a9cdb3dc5dce0ba4f155db7656717c9cd4173a54e7c62399560768cd52daff5ad4e19043fb02ce3bec12889206f24e9584f780ab9c78337a30efad391f9bca7a
SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzywFqw0LezI1PF:A3kM456r9/5I1N
TLSH
T116455916A2941BB5D16F8134C9958662E7377D620F208BEF1350BF263F326D0AE39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3916-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4912-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4912-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads