cd4ea0fc64f966a1438f6bf30bcf1c0e9559b4e545c5a7ae96d24b8eea245ee6

Analysis

max time kernel
107s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 14:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_a6ea349a24423d6f024cf98ab3a02b62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 915KB
Sample260721-r87rwabc52
SHA256 cd4ea0fc64f966a1438f6bf30bcf1c0e9559b4e545c5a7ae96d24b8eea245ee6
MD5 a6ea349a24423d6f024cf98ab3a02b62
SHA1 78de54de3bfc309ed3d5042a9e1e80fdc15d59f4
SHA512 e5ad5f4c20c395f3d57ec545c97edd456410188e05b665e20e5c628df6ccff4cd474cbaeaf3c03ca5bf82102bfd008a594c1bfb4c58e6e6ff53586b8e22646c0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAp:A3k03kB56rR
TLSH
T1A5157B13E6940FA4D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3664-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c589-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00090000000167e7-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3664-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5944-16-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-236.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001bb33-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000198ed-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-564.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-638.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-767.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-799.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1087.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1167.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1333.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1353.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c589-5.dat	aspack_v212_v242
behavioral2/files/0x00090000000167e7-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-41.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-236.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-261.dat	aspack_v212_v242
behavioral2/files/0x000300000001bb33-442.dat	aspack_v212_v242
behavioral2/files/0x00040000000198ed-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-564.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-638.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-767.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-799.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1050.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1087.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1136.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1167.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1174.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1181.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1320.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1333.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1353.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1373.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1380.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5944	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-21_a6ea349a24423d6f024cf98ab3a02b62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-21_a6ea349a24423d6f024cf98ab3a02b62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-07-21_a6ea349a24423d6f024cf98ab3a02b62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-07-21_a6ea349a24423d6f024cf98ab3a02b62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-21_a6ea349a24423d6f024cf98ab3a02b62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-21_a6ea349a24423d6f024cf98ab3a02b62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$	patcher.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_a6ea349a24423d6f024cf98ab3a02b62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-21_a6ea349a24423d6f024cf98ab3a02b62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3664	2026-07-21_a6ea349a24423d6f024cf98ab3a02b62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5944	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-21_a6ea349a24423d6f024cf98ab3a02b62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_a6ea349a24423d6f024cf98ab3a02b62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3664

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 915KB
SHA256 cd4ea0fc64f966a1438f6bf30bcf1c0e9559b4e545c5a7ae96d24b8eea245ee6
MD5 a6ea349a24423d6f024cf98ab3a02b62
SHA1 78de54de3bfc309ed3d5042a9e1e80fdc15d59f4
SHA512 e5ad5f4c20c395f3d57ec545c97edd456410188e05b665e20e5c628df6ccff4cd474cbaeaf3c03ca5bf82102bfd008a594c1bfb4c58e6e6ff53586b8e22646c0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAp:A3k03kB56rR
TLSH
T1A5157B13E6940FA4D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 2890280a586a8bcf10dc90943164304364104d1d23aa2a92f366b9b3f21f4bd2
MD5 b9dc84323b121ec73fa978607428602e
SHA1 d08377482872dad27c334354c3f9ace29a38341a
SHA512 61dbbeef994e12042067c9de3dd30deb5d69e4dd971af6fd96635ee359f3896f48e975b2919bf00fb0212e3d4a343cb40a1194c1ffaba027e2e33425eddcf9a7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAV0Le5ji0hmxNrM:A3k03kB56rtPji0Aj
TLSH
T1D4654A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 930KB
SHA256 aaaa6833e234efac9bc6d7a9d1ae6f9549d4b81fdd3c0ffbd3117d49edb48924
MD5 428d77def726fb54dbb7d535ac9e1ced
SHA1 f7e9ffeed281ec12ff636108a11057334d4e870d
SHA512 b86dcc220cb8d2a17600a19d0ca1f1ca5325514b63ee8cef5ee2d6230dff9ae7e949fcfea1eaecb1c6777a7c48e28b2ac77ca6328da0dfacf02580af3b99da49
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpA3a:A3k03kB56r
TLSH
T1D1157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 939KB
SHA256 8da11641117357813b736782a8e852f5a61cc46efb8fdc91f79773f979ea6ded
MD5 f7347516f0f41c7cfcaa84356512870c
SHA1 b70840c746beb4038bc4a618297b5edd0154b9cd
SHA512 cd4cb704218a9977e7e86347e69e23ee8c18eb7e9a3cf67f49322e38e065fedd818a83ed2416285e32a1579662bec4b75142de5842fe58f1e23837d7fde421b7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpA26:A3k03kB56rJ
TLSH
T1F9157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 939KB
SHA256 523062c6066019fb470f3eb5e437a57d7cafbd704faae78df461f382e47a4504
MD5 b21c80b771086c54ec18652512e7a4b7
SHA1 79da594578cb016f98fbbabaa5b0eceb0f1a7ed9
SHA512 5366e803e5807248f9fd460a7c16dec1b87eb153dc80d33c3a1bbfdb5dec52d8f0534a4cc239fe72491e001a23a1db4ff5ad1b931a1b85ad8648625a6e66cca5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAmN:A3k03kB56rw
TLSH
T18E157B13E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 939KB
SHA256 11edb188106e87ab00cdb5c67986712ddea7e1a5ff58755e175cbcc76f1c45c4
MD5 f5b87900f1139a0a21608c67e804be6d
SHA1 489a8431aafffa156cc7b4231bc5d6056185515e
SHA512 d4e4772a3602f26c721d7d4e42f7493f65f682a3a173201b8d5eed0386d682bfc0173ec666df76eed8f2db14a8d88b91f5a0de2564a050c941cd5f41eba30f96
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAkf:A3k03kB56ro
TLSH
T131157B13E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 939KB
SHA256 84acbfec5060aef8e534a574c504179f61e66d3a492fea88bc44f010563e72c7
MD5 3152a8788ac2e2f7fe492572a6781821
SHA1 8901082f188ecc36b8152a6ea8296724ff41e572
SHA512 225c30cd1fbb9879338c6f3381b7cb6599335de84cc131893bf1c5288afd75ee2d45b14eb45497ed357e839a1e3df4fabf2263ab25169700cad9997badc73e4d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAOo:A3k03kB56rV
TLSH
T145157B13E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 939KB
SHA256 861eb909c90d6f6c22c38f9903920b249f668f41fe5fc3f5f655bf66840ff11b
MD5 b33f8199dcdc855f10942a501f0d7e12
SHA1 55df0d3e4f4807f8afd65dcc1e2484d53b0eb502
SHA512 353cb3a9ba4ec112ed3fe6612b3c9468925cd47a066e51bfa504b0b3c85c9a1c155c9fbac80bd1124ede23c37cd6594d8b7b4a7b2d832b451585f240f53e5781
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAiu:A3k03kB56rX
TLSH
T18B157B13E6940FA4D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 939KB
SHA256 1ec2d9c67839969f3b6469d9f5ff4c9ff1c92524dbf0dddb31931a1c9966087e
MD5 ef688cd900ed165d0b8ddb358b1015d4
SHA1 69f585242f8d4256928d235bf483cb6869833495
SHA512 b2d537510aa511f0966071024705972f9cfee1681cf5a1e6c6fd2111ca563b62234dddfe0db6036e979a4b35e1d1e03bc85568b91c9568e8b0aa384eddae205d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpA29:A3k03kB56r2
TLSH
T154157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 939KB
SHA256 4b5f4d74481bc36c94dd12a8c2da7bdd8e94dc282706cf6ff8d75a7b2ef32aab
MD5 67f08081f8456f960972ecf0a0a52e3b
SHA1 189fe1a6337480a99f734fa59a8c984ba76e18ff
SHA512 78bf0ce629fd554012133209f391e8573f64b7f1a99082b96e7c6309b18bf884b39c29307fc279027ce1c1d7ea3b8e43e4eefc01bbb23afa9d16c442090a6711
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpA2c:A3k03kB56rb
TLSH
T136157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 939KB
SHA256 ee998c8d82e86dea80519f1c1e62f24a7cae35103db829d16958823beb2abafc
MD5 b34ad67bbf1e164ca85bb28d6b31dab6
SHA1 eb6d1d292a506d987ca0d7e482aa124c70a9792a
SHA512 46ce7055e8f25d92b7d3784827bd15c147a236b23bddbb6df586c29ffb2f016f50bad59904a05b2d95f723d52766c8df6b20f4e00e7597097df524c24020abb3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAvp:A3k03kB56rZ
TLSH
T13C157B13E6940FA4D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 939KB
SHA256 61eb5d7edaed2d77eb6c9aa1ad87d4fbd19dd0a8848de05d3a56013eef3021b9
MD5 15e73e99de59c0c16eab9ca0c965b18c
SHA1 2dc8728cdae44f20e2b6cfb655d1a1cfd72ded38
SHA512 0954c25e98931d42af055b554f8a318230dbcabb23ec638f9f00602437d50702e4f453b5768df603ccf8a67dec790506ac891aae9af835111d66c4e3a1f2a550
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAQN:A3k03kB56rC
TLSH
T150157B13E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 939KB
SHA256 c0b00b15df5f547b2602944d129809de5971de40c7558a74dad0b423fe64e09f
MD5 540e901196e66a643521f40a5c101fc8
SHA1 2b1d70add2502a9dc69afc8e2b28b6a030579c9f
SHA512 3a311c4e480f5fcf211a30ec8d1634a7ae87680bcf07d148c757320e2ca2b3da255c05f067a7f99f7e4aea2e0f1ce7433f591810dd964ea564dce2b415cf19a8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAYF:A3k03kB56ro
TLSH
T1EC157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 939KB
SHA256 f979a34b4115a245ab4bdc105624281a23975f38574d314afbb79c4548d64b87
MD5 7433b51574ffe0f98e0fc546f1a463c4
SHA1 c03e5e482213f2bfa0c7f6bff6e3fec85b628356
SHA512 5af8985d30fc452d36ee77d293a1d486def2db46fdbef01001b2667acc4e3bc5541acb4523dbd8dbc2a2bcbc76a3aef73d103df006c5a4783fa76846acbc3e60
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpANC:A3k03kB56r8
TLSH
T1B8157B13E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 939KB
SHA256 92c2714221b02c66a7a71913839ebff38d80f39c613fe0bac791f91a30fd4885
MD5 432b1aebad79ae02eaff3518821788d9
SHA1 fa25e1353cfd621137f368e17f682a7beee7926f
SHA512 438cea19783c11061b46452e47a1e7487327dbfb98b38975925c28fc32fb6c8e01291df689c215a48734b6f268d378356a6c93f6f3b18d4556f8ee3bab66c493
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpA2w:A3k03kB56rx
TLSH
T1DE157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 939KB
SHA256 b2d6f9bab8c927ff665139bbb3b1c0fde0522eefd8761818a3b9dfb3006d2381
MD5 fa87b54a550270280187457959a197dd
SHA1 2824c6f311c2b18bdd01db40256bfdd02de91c7e
SHA512 ba30f3e3ab0a5f3da8c8d315da2d19cd3a03cf126a62c12e43d16ecff7f57ff38e0f4dde1611493d960e49248d75d419068b7b82cc47e4863dbae08ef22ee5b0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAlT:A3k03kB56rl
TLSH
T1D1157B13E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 939KB
SHA256 c05a96b453524dd29b83281052be947eb2ed0ee65ad35a3843b7e254543b19bc
MD5 944542f98223a032de089564a3f5ccd0
SHA1 3bf33070200cdb4516b7f7b0b26130325a4ab23b
SHA512 82b6223ce8d77031aabb73614ab8b986012f11f00ec345861a00168fd53ea5d7be66031d34b9d28389a74c6dc9307b80e5f44d938874c6fdb0259ca40c8a6af8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpA7u:A3k03kB56ra
TLSH
T11B157B13E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 939KB
SHA256 237148f83db2d9bab409904ab1f507657529b79cde16eb7812a8f25d8365b6ae
MD5 99807904fcb2a92ad213a18e62645a32
SHA1 2da1b163d34219373b18867dffaebd739e7f68ac
SHA512 1abf124e1f773cec8f2daa4259d01f8b556a5eb8a02e6551c0791ee7a2cf4a1cc6cfdc37a46eb7138824f9f77960cca9727e8a79724c1f1e7770cc07de340d24
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAfb:A3k03kB56r7
TLSH
T198157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 939KB
SHA256 d5f97731ba638e031011106d52420799bac9c44a373687680fcf333e1e8377f9
MD5 3edbdf24234683ef2f0b153ae8b455f9
SHA1 f9df1286efcc146a5e48e1e93bcec731369119dd
SHA512 9e15f6c745e69bd06dbadae9dbb881a17905bc58c7c4e615768cd26f108a733fb47ce17d2dca3fd5dc8a3f7f58c67308e0b31b0e316f52a82522c853f87958c1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAbf:A3k03kB56rD
TLSH
T111157B13E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 939KB
SHA256 f3af8a1c1eb3189592c130fa91f085ebac3b82fef86a3a8f2a8a7fac062f2cde
MD5 3c15e9673aa708affd03467aadbd4747
SHA1 ee40010ed963961856352cb1d4e57368678571a7
SHA512 02f1f63264003f744eb5cd7c471451dc3e209c2b9a42fba404501a7bd5c1a28f0850ee540073eb1d7a283e9f16ed673a2bcd2ffb723f2d43c4c3f3a0ea14fd1e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpA0K:A3k03kB56rz
TLSH
T1C0157B13E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 939KB
SHA256 08fe81122191c9e38531f8a7bfe8ae4b500c33a0acd560586a955312a694945e
MD5 f2aa0719d5a61a4f3759eeb0bf03dbd2
SHA1 653387cf609d983e278733cbd505d21fef120c65
SHA512 b19d01bfb360384989cb01237cab747c467ec5b38ed83aab359585f2514361de103b7ae2867fd7daf7ed3eb4ba31775817d28adf9c22a88b7258918fb23edd99
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpApk:A3k03kB56re
TLSH
T1F8157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 939KB
SHA256 a600fd48eb3fe0b7a065a40dca1e856d7e3e47ec05007d211a38fd9dd7d52b62
MD5 9abf949c9a7a11d7eec4ea7b17c86b84
SHA1 fa0e9a874f7ee63cc01274c92e9a13f8e8a22574
SHA512 29ba0551946a254c6e06a1d5ece779986b1e861850743bc0772ab921299658bdffdb7883bbde1b0bbc72b98e992546a156708c11acdafec404ec26a5308cf6d0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAG0:A3k03kB56rD
TLSH
T1DB157B13E6940FA5D10F81749A968662EA737C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 939KB
SHA256 2ab51866aa41b39521736e656fb3a7c5bd9ac129539e9d69d720f3b72cbcf44b
MD5 d9e40ea3a4a1858159fff79c2ec02c86
SHA1 2bab6741c8bb2d91605a2f21e7d50f5e9de5f4dc
SHA512 fc4c039c76df0176f3c2bff2190fd126ea548680546d53ca52d7f5824d52940cb847ef4f657d80e6c66bc5e5410b5b68297575bda1606f48440efa008defdd65
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAVg:A3k03kB56rm
TLSH
T1F9157B13E6940FA4D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 939KB
SHA256 565d372d0595aea507ee922d3e80e950232ed66e4fd8737afa76c0fd0cc88f68
MD5 167723239e59cef599d3742976c4d390
SHA1 1236fd4f62576e4f12ff063aa6b264e47423f19c
SHA512 0bf9423674378e9d1cbd868534c19edeaa84756af6eca2719e2126011a2d1d410bcf8363be790b37e0403f641982c4bf05f14d25803635994ef68832d8f932a5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAkr:A3k03kB56ro
TLSH
T1AC157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 939KB
SHA256 7728de98f74cd94970998520d7c2c27b169f5044350b7c0134205a9cce7c7e40
MD5 ac54bfc09f5e18e60055ca0338043f2b
SHA1 c8dcc2eddfe1f3df5b1c702015469302aba65a1a
SHA512 5bea3883bc11c94558d672d7b7ff3992ad8fa049810891c9680ac85903c241bcf9e0c8e601dff9083dc65e1b388ccf0243867c57a94549ab8e4f1597b12a75e5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpA6n:A3k03kB56rK
TLSH
T11B157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 939KB
SHA256 92306a5f900d7add52b0225a71051263602bdfea22da136ecf5d73e746a9675f
MD5 b0c26f6ebacd433bc6c61ca4038cd7e4
SHA1 67f6b3d6b1c6bcf5504808583984532af3584ed7
SHA512 a4fc840720e190d27d9bf7af1ae7197eefc776a5d6300b9d378fb54db95dac3fd554da9fa328da0c0613dd294ffabf37c50caf008ddf45b0cfaf8197ba398f0d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAQx:A3k03kB56ro
TLSH
T19E157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 939KB
SHA256 9bb93ca7078c1df040fbdce18f07ccca7c64510409013fa5a1381cd6abc00694
MD5 cfff38b561c8af7cb319924c91cb5a35
SHA1 156a1785d1fc6ced1baf5ecd911455a35a24e286
SHA512 e5302b5564e30a239f4b3c673c5e3f3a7008f28c5a5e84ec7c6d7dd2da4c875257a7c8496f347692b022b6fd518b9fc3b3666d6757817f40cd0c5b1ca7ed6c3a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpASA:A3k03kB56rr
TLSH
T1FA157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 939KB
SHA256 b6ab12808443423120387c202ea7a7342421eb8dfcdebecad3dbd3400bb9f676
MD5 198584c8fbddfb7f519d497cf849d91d
SHA1 1d5f63a255801e8bc14b0c1574225afb3ba873d6
SHA512 d0c04964c407f5530030014062d520d10adcb926433ecb427a1317f21e6eff4d7006dfa7bf4dcdabe99c829e08be82f878d73be0c614d9c8549450a240b80e71
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAr9Q:A3k03kB56rm
TLSH
T10B157B13E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 939KB
SHA256 7ddc489074b3b6ec045dd1e02bb848faef6a178dd040a88e820df01fec242676
MD5 bed1642ced1ae00cafcc6abe97a99aee
SHA1 6d99b9972d97073882105abbe38ef83148952eae
SHA512 93da9bc42420b8e8910e0d1d6b743894a76f3164fd163cbdf6c353787124fd9ae4c066f06c157ab2643ed7afe245b0b3ab5f01a973f2d08051eee3f3a2d879c1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAa4:A3k03kB56r1
TLSH
T173157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 939KB
SHA256 0932f146a851fce3725c3cf64bf96b69495ff0052a131332a312d79f4a11a0bc
MD5 d67a078dbf2240d28b874be65dc004c0
SHA1 83f98189de88d88b116c1e45b11a7f1bb065ed23
SHA512 46d22c81dfcd0eefa3ed3e5dcf6f4b02ece970704aab07ed27d3d100aeceb74270d9f1aa5d5b04d93ea5848aaf4875f171bf64dcd7ef807d8e521e61830f2b72
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpABu:A3k03kB56rg
TLSH
T1CC157B13E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 939KB
SHA256 63ad78218f493ebe51d06d2836ca6b0b7c72b3c8a7f1262633f822f3c0c51e5a
MD5 fea7f8f1a82d295ef98a0a1b2410eb76
SHA1 6d2ef17c8c72b81d5473d767757f6ae5d3397fc3
SHA512 7d423817f1e72482bf497a6688661aabb9a3e6d39b42c1db2feecbf6794c833a2ffacff6021af7002ecc7c945d773e20e599fadf3276224344fe82dba99a634d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpA0j:A3k03kB56r6
TLSH
T166157B13E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 939KB
SHA256 982821cb92c98015ba95311424f611849a092e0d59ef4e03607c470ee5aacc98
MD5 6fa4ca8d9a6a26a399d4e05b3a872c0c
SHA1 4a9fee133f447a8316291aff28b12a296b41af42
SHA512 0495eb8e50bb79d8a9b0fbc14e8c1c0140aab4eec186ea8d532248ab9d2508a4322f135bd2d4bfea452720e85f7853f7b35c8bf67f9b780347ae4cdddbbf10c2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpA1g:A3k03kB56rO
TLSH
T19B157B13E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 939KB
SHA256 197dccc8ea9615d7d44d16948dfcfb0a128d6328a9c15210c053df393356a8f3
MD5 a60d47c2a6375ddd72e9994b5a068b49
SHA1 5bf709889b901a2713e6b9295b5cf62f30359545
SHA512 69ea550a83232e0fce354007954d018bb9144b582096fe1aa9aef8979a49b7b4c6f2de612ae6031d799b030792a7934802163b6ecbe1b8e46e8c70327e3d6e1f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpA0I:A3k03kB56rH
TLSH
T110157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 939KB
SHA256 e9f1a8f056c5fd7f6f5326e8c7be35102516748f2b7bd50d37158d7f118abac4
MD5 f2561d7f772936db28283c8f5e11d042
SHA1 153f80d331224bf9af674b83cad50d8bf0b8dbfe
SHA512 17af97e551b322697e5c7bde2ac1b6bbdb055dd983d68ed5cf312955b0d459988947eac854e75b8136800fde81f59d541c79f0d7718c8c999f21498863e659a1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAmo:A3k03kB56rB
TLSH
T1BA157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 939KB
SHA256 dff8cf2d6207a7d19498f300eb97f62fee31564dfc42cc7383b81cf3a9cc4d22
MD5 627c56dc22a5fd17fd26c411d5df8f6f
SHA1 5cdaaf915a1f0be7e509a7ee669c79f8a029256a
SHA512 197f3d3abb80b3cc20c00654b62442460e37d11dd2e5cb5cb4b182704780a93d7d2e583b0aea1d48c26aeea065b10a017d9e0b0b5c0812ddac39d03ecdae7282
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAN+:A3k03kB56rE
TLSH
T18F157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 939KB
SHA256 b57fec9daa9d61b570318588d0f3f40215e4c6908ab1a61aa3111e2bee9fb774
MD5 7f7bfe16f1b4986dc385c14fb21bf2e0
SHA1 ba6b8888799edd9503b71f22951619ed7a64dcda
SHA512 f30ee3c2af59de254e16f9991d5dfa7f63f88a3489cd09989cdf1c980ef12bd61a6336b8770634ebc1bded82ef4cf783e58c87caef267d5d837d3ce5229d4db7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpA7Q:A3k03kB56rM
TLSH
T1AA157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 939KB
SHA256 2e0b2a91205b7714d22e8a4e08a68b358d15726264745bc978a6191d81a60fdf
MD5 baae31b3fc0bbdd3c55db944d34d85a4
SHA1 862f4890b34524a99a246c7eb70a3b4643444cff
SHA512 c8a53bd8ae85dbb49469ad68cb807c12583a98b05f70107bfa879cfd82bcb847530269538fda4f680749f4b958a73fc942c93a7cfbb2f6605c582d9d7eb7dc05
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAwX:A3k03kB56rM
TLSH
T14E157B13E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 939KB
SHA256 ae750055e5917512687e1e07421f9ad5a2e937ddaa24dd128832f95842bfdd22
MD5 d33ce5160c231c4b144f7ff91b3b9ae4
SHA1 ceaa55fb5a419c907ecca09a4091cf192a5f163d
SHA512 5a1a3d4bcfbe72a13652b5a999ead32f830a594fd181bffdbb51c081e18d6e614f3bf22ba20b9e11eda33f41e388121a802e0bc35936f20211eb5b7911b23fe8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAGL:A3k03kB56r2
TLSH
T11B157B13E6940FA4D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 939KB
SHA256 eab1f7cc89b9ae72d6667ea215ff35bb46a4b6c88403abbd00e1bcc6aee1f8df
MD5 78541e0b93d6ea9927cfb2f843c7591b
SHA1 2413560d7ee6ebaacfea5d4fa937c4ac102dc1cf
SHA512 c7b0819d2ee2df1c47ba0cb61c6294772b1821fc904f28c3a215adb2172d1fffcc1f9f4cf9d840d3fb189819bbc27f1e5645c0d17edd9c31639e8d7018aab11b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpAaM:A3k03kB56rz
TLSH
T198157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 939KB
SHA256 291c11ae088796b0201d87cfe251fa9da23c492bfca5663e24e996629fff7daa
MD5 8e9b59f0beb726da2ca353b5e7536b69
SHA1 a905c3273eb856e3922efd88b11236ec9614b71b
SHA512 49174003ad4d82c79908375beffaca642226032c51e47814c875dcc3b9c054c39e706d737cfdb2c2914474c3a7a2bd39a8062af778e23a1b02c4df7b383b574a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEpALh:A3k03kB56rt
TLSH
T1DD157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3664-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3664-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5944-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads