a9cb015c652aa8427c903f133429e1df802f2a24ae1eaa2177251fb1b4ec301a

Analysis

max time kernel
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_61437a3575a608c2bfb1997f66eeb25b_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Size 835KB
Sample260724-x2p65sdf93
SHA256 a9cb015c652aa8427c903f133429e1df802f2a24ae1eaa2177251fb1b4ec301a
MD5 61437a3575a608c2bfb1997f66eeb25b
SHA1 48d3fad5e14c97efbb3ccb66aa4cc6c8cf439afd
SHA512 cb4b9f1c8a49f4231dc4353389e0f29f337975d341b8045ab9a710678748629a6ac79f50a968709afde5d797ba3c52e84e22b7644390abbe2e150d2aa3f52b7a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxSt0l9:A3mnXoZjzyacNVOE/jeD5TvinrmxSta9
TLSH
T1B6057B07A6940FE9D11F817499924662E7737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/3036-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001b859-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3036-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5356-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2fe-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c86-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-227.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-265.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-410.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-483.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-502.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-630.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-709.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-783.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-804.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-911.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-955.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-980.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1011.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1056.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1093.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1142.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1155.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1187.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1346.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001b859-6.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2fe-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c86-60.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-227.dat	aspack_v212_v242
behavioral2/files/0x0004000000019842-265.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-410.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-483.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-502.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-599.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-630.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-709.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-740.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-783.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-804.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-898.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-911.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-955.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-980.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1011.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1056.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1093.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1142.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1155.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1187.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1224.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1327.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1346.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1380.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1387.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1402.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1403.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5356	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-24_61437a3575a608c2bfb1997f66eeb25b_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-24_61437a3575a608c2bfb1997f66eeb25b_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-24_61437a3575a608c2bfb1997f66eeb25b_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-24_61437a3575a608c2bfb1997f66eeb25b_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-24_61437a3575a608c2bfb1997f66eeb25b_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-24_61437a3575a608c2bfb1997f66eeb25b_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-24_61437a3575a608c2bfb1997f66eeb25b_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-24_61437a3575a608c2bfb1997f66eeb25b_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_61437a3575a608c2bfb1997f66eeb25b_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-24_61437a3575a608c2bfb1997f66eeb25b_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3036	2026-07-24_61437a3575a608c2bfb1997f66eeb25b_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
5356	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-24_61437a3575a608c2bfb1997f66eeb25b_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_61437a3575a608c2bfb1997f66eeb25b_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3036

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 835KB
SHA256 a9cb015c652aa8427c903f133429e1df802f2a24ae1eaa2177251fb1b4ec301a
MD5 61437a3575a608c2bfb1997f66eeb25b
SHA1 48d3fad5e14c97efbb3ccb66aa4cc6c8cf439afd
SHA512 cb4b9f1c8a49f4231dc4353389e0f29f337975d341b8045ab9a710678748629a6ac79f50a968709afde5d797ba3c52e84e22b7644390abbe2e150d2aa3f52b7a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxSt0l9:A3mnXoZjzyacNVOE/jeD5TvinrmxSta9
TLSH
T1B6057B07A6940FE9D11F817499924662E7737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 89984e003497c1d0f2e4b29b8d279f9218b7cfe853a94916a7737c9b9b83c8b7
MD5 251201d3f4e632179e5e94180db9fc22
SHA1 cf3b5500d225ed46b8ae531c8cadec3921dca919
SHA512 5e6fb145959d75dcacd27121b144f79c3c48a9c7c1612ddebf0a6cd4e2ccecc6fe7af027ed6c476061a9a6d2dbfc8fad31d6887bd2979558e6d0d1d924a3ee81
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaJ0Le5ji0hmxNrM:A3kMP56rgPji0Aj
TLSH
T11B655A16F6A44BA5D02BC078C5D2969AEA733C425F3087CB13549E283F277D19A3A773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 849KB
SHA256 689808051c9453562df3a4856f9dc19f346bcc457d539ef2d6e83f027dc6421b
MD5 3ca04a43770bcd9df0226ad2ea581912
SHA1 2d7e15c8579dab48ee7c9a8918caeecfe13ffbe9
SHA512 10d454f4d8f1e85bd1e212cd6d3a00ef4f9bf2b2ce30617133c376e0791b41463bc781d2ad1c87c3749de2deb0f7cf3ae84bd6cfc50dd49038f6fbdecdcf765e
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaba:A3kMP56r
TLSH
T17F057C03A6940FE9D11F817499924662E7737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 882KB
SHA256 8bce5b30eef85c44ad84b7ac374b05ea426f6dba75af4dd321c439f5afd9c6dd
MD5 2f8fb9d4e2d1787773d4e69ed6a3ea9f
SHA1 b34527f562a5aeb36b55107f32b17be1a551a50e
SHA512 7f04fa79569d8a5457c4e5d6d8623a9deb739118aed0fa205907db64b5367c33b6e81b31b9d34ec4ae1724c8267b462a6a89fb946de839c0eebe7a9282514e43
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxSta4b:A3kMP56rJb
TLSH
T1D7157C03A6940FA9D11F817499A14662EB777C525F2083DF2358AE253F327C06F3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 858KB
SHA256 c7124d19e0ec77f2087b7ef3380156ef63c57a2cf70424f998d87a2f947bde8d
MD5 a1de0310e101c0a2e28f04caf65b842c
SHA1 cc35a77c0e17fa95516cb04b6f8561478f1f0dde
SHA512 672ca26a87f18d290328026f33e040f8e6aae6584fefcf0e023be9e76c4c8d1063efc0290893f9d1296e359bd26a2330afc66d0f45d263477ac9562c47957e5c
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxSta66:A3kMP56ru
TLSH
T15C157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 858KB
SHA256 8f84dd76587e27a71e2cfa5feb9d75fb74967d277d1188155c10c0ff6fab271a
MD5 e843e5222d570d2f127de0ba28244ae8
SHA1 15e5ca551c76239150094673afe6209f382188c8
SHA512 6e0b3dc2e9e18df5de7b795afa88e9252aba7118f68946f443dae5ee2011400d9770b65299d01855fa058da8eb180e484b38dcd997e461c2ea406cca0f7d9747
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStayN:A3kMP56rv
TLSH
T19D157B07A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 858KB
SHA256 e19b9730333486c139717882c1d526c82828add3727617c320f8498133314314
MD5 98658adcbdb2795eb28d2bb624199189
SHA1 057610cefde2f60320018627ad1013a70622e092
SHA512 1eae37f847e0518a8e892fd4806229d01b8899a48b0bb71add691dcc62d6fc1e7581d588169fbbce012dc336c29dc482094a1ed997cf868027f3e9fe3718d7b3
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaof:A3kMP56rr
TLSH
T13D157B07A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 858KB
SHA256 2b36d9a26a69e9b4c3796cbf691ccf982b78fe69a69b5340dadd94379c60837e
MD5 29e0b06b845fcb194158832f51ab6288
SHA1 a5eb118c900aa29cf962b2a60bd85e822ac03e58
SHA512 e5e1fc90a4bd6c7cea35736e96176d9935385b468499e45aebd7cedee1e7d5b1b7bce980f8014cac0b79b796fc5d247edcf8ed9a69b571b0acc9ce86561c461f
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaCo:A3kMP56r6
TLSH
T1D2157B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 858KB
SHA256 3cd4ffc6870fa1f4283830c9be9d07fccc2cd04723300c9a705186cafb59ec48
MD5 fc4126785f6b8bba85262d15fb2687e8
SHA1 56c15c63bfc8675b785c0748139756b3d063f4f9
SHA512 dc8bfeb8c5e3abf3e6ee7e516dafe155dbfee3363973538642ef4df3f69e73bdb84b3accc94f0dd473f51a484fbfaeda63998a5597a11ef177427e39e709a2b8
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxSta2u:A3kMP56rU
TLSH
T1D0157B07A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 858KB
SHA256 8e9d0e878080cd83ab23530b62de4861307c23548f9291cc728229e5bd203416
MD5 cc27cf7f60e744813979d6e0c6ffbe5b
SHA1 395697ba0b00593fe7aec14d01a8f39b771ab867
SHA512 d5b551a04595ca641c6d5c8f5f208fb20e1a7dd622ac4fdec21bcfff66e6829920f870810a040fef6a913c18e38ceca61c103972fd3324e4e7cb6e38787125c6
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaq9:A3kMP56r5
TLSH
T1FD157B13A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 858KB
SHA256 6d101d99e6ac97272a6cc2561b41bd8c34f2ed728e9f1ca64aee04cc233454a3
MD5 2273ed736759052ed05c016aadacdf5e
SHA1 ac11ae73bf313097652035be8a7132edbcc0d96e
SHA512 6ee267c00103de71ccc4b640eb31d59261cd7ac445d969b669fae336a2275921c0ba946ec06dbe9e70c6aff30c43f1a9cf27a76d2f6f602550fb9c6cab64c673
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaqc:A3kMP56r8
TLSH
T1AD157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 858KB
SHA256 ada42b1aa709aa82ce4378234cfd6518bd55e409b76ab4d7f6079e8c6de195d0
MD5 331eddddab2cc996eeda0d552e015a96
SHA1 279d8fa3f7ec816c0d744e9230a148fb60a2bfc8
SHA512 13bfdef498142566a81f432551fb13d6a144d193cbdfe16da11144be2c77577de887b158b80981dac8d8411e8cba8f08470f2284ebba47d0867e6949eb9cf267
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStajp:A3kMP56rK
TLSH
T1BA157B13A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 858KB
SHA256 e01c9347985bda8c076fda079bee4dde8caa3509f4173c6ade19b4a7d71489b2
MD5 f46bf17e361ec7165966aba2bb783ca6
SHA1 318d39521db2dcfba03be85ef545f9f614dd99b0
SHA512 1027a23e934b08e82cd3ac8dda873414c4f7349a58a111e1315e9931c3ccae690377b02e44dcf73559d17d3cf7f992210d8a0470a3cba01db1d62723aebaf5b2
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaEN:A3kMP56r9
TLSH
T16A157B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 858KB
SHA256 b8e1742312713221439af8794543ff2a1d1d71cc3cb6a4a8fc65202d513c97c6
MD5 cff60ce80a5f57bd64a7c0da04c48843
SHA1 a2a887a31497bbcda47586afc4898fdfc394945e
SHA512 2d7223f44d65592febc3e22588e1307acdc80af4dadf4546e4d803fce525debedde09e887154b0862a93d79d0d4f047da5f7eb4bfd6b1032433ae6fefc686a14
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStasF:A3kMP56rn
TLSH
T179157B13A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 858KB
SHA256 23452c42568e94706ed6c32fbbec03639f7444b443db8e087a6d00e01d2f4187
MD5 c6ac93d01ef16c987754fcf22f4f3dc1
SHA1 87c7911bd1cd9c7788b8f922e6068e861fa775b8
SHA512 48edfa8ffc5134edd53450649bf2cd84173f544ad25e5a9e846b74e76665058f8ad430c120b82cda8259550c3f713d7d07354c6034d2b1b06b1828c1aff00f52
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaZC:A3kMP56rb
TLSH
T194157B07A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 858KB
SHA256 a3dc9300e6dc22d93896536dce05907df0a77fce5eb82df7100825b0b0389a99
MD5 9bbeff67e3ac0ba285ef7062664ff771
SHA1 36baa8a2a35b1951cf09fe7b522489e9cb3e9609
SHA512 4ae5749ca9c64710b9d9c94e552b85293e26c8bbbbf375b1688f56c7a05c17da2cc6ca9ef525eb44599c3561f6062dfdff5bbe483cc1df27628a2c0b2a7ed31b
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaaw:A3kMP56re
TLSH
T16C157B03A6940FE9D11F817499914662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 858KB
SHA256 8949a4afe3ab3433697959f17ba3310b0fb0fe4d02098109b5bf1c6ad2fee24b
MD5 13cae4b878083479ba0b08a7ea980032
SHA1 17cdac8ee30a6ba30d467f6e6a44f87aa66d9dc2
SHA512 d58d82481a281d4e9a566dd5cd4e27e96aaee5f494aaab05fc45fb9931f8963278c8f0bfdbf8907a2e205c657f8111cdf5567bf383ba259eebf38ee272cba081
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStahT:A3kMP56r+
TLSH
T14C157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 858KB
SHA256 6515e2ee5576cf9bbfaa68d978a610f8a53fb581a8b9315bee8f6cfdc7735246
MD5 2bb2f8fd43b1ec7f49d98f2f7691f24f
SHA1 3f638ae7bbd2cef4dbd5aa9f9f760ae22aca7295
SHA512 04b8e88b9b833fdc30fbbc4adccb8d7fbc41d86c3d30fa5cdd68879370dac44700cc33476178726780b06ced56a4ceee7c17ad2b1bc31f47634d7f1ef8947dab
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaPu:A3kMP56rp
TLSH
T142157B13A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 858KB
SHA256 822a16601d168e8843bf0d2c409a604e2401028cb6dbae109641cdb780fa2f44
MD5 387ab81cbfda95b05cdf07f4985296d9
SHA1 b5f5e338fe774ba793836cf9de734a88f4772627
SHA512 7304ff9450d69eeab8ea63cdcabee3213a23a967a60c88540911bc95c31df78fa7bc5cbd8a09b89b4ba08151bc7b94f18292b5f5ab43ea5c01cf320d58dbcf4e
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStazb:A3kMP56rY
TLSH
T1FE157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 858KB
SHA256 7b02bae0fac9f55e09e97b9aa996bfd6bc92bbcac3ac31690065d49246892425
MD5 dda04a294360283ce6c10a4d1a2dc282
SHA1 0179e0f39830c3e8535c64344f11a60bc25e22b9
SHA512 a46ad074a499afba6bbc965e8a7a9123fcd8a58467c1df2ef2323a6aeabaeda9bee3a4e20a5e29a194d351202487c2ebf7dc48437a82823984d090a8b78673bb
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaHf:A3kMP56rY
TLSH
T12A157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 858KB
SHA256 1ed91c1505f4bf819c7716a35d3754ca8982355df1f6475af57030780812c05b
MD5 c5532db60265ea429f304c4a4f9c5266
SHA1 5b1fa20dd298c36ad2634f91bf553bae2ec77d55
SHA512 1a9a106c53a0f000301bd056bc4da757f043db0542c7efa344e85afa82e5915a3beda107b5facf1f24ae70b0b7cbda577fd1b4b3c5e95063041df49efd910f53
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStawK:A3kMP56rY
TLSH
T1A2157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 858KB
SHA256 a07bd569697978a04fd01fc25f178bab2336c9839f0077849dc31b670f66f3b4
MD5 d1dabdf9c01ad93246d2fac46bcb555c
SHA1 22d5bf53ba6c0fe5a347b14eb1db008d37c4c1f6
SHA512 80335ea406f817821be4db19f97b108704aebb9b8e9246618f545ff98c7186c6997ae756bb65aa15ee1490dba13e7d5d22ea1db56c887a0d0f46642c3cf6c954
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStatk:A3kMP56rx
TLSH
T177157B13A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 858KB
SHA256 8d6dc9e948283515f442af8f10524c53a00ede40d85436770a1daf88e039c780
MD5 972a765c385bf0c7af6c375e59d364a6
SHA1 9b27de61c7e7edb6ee7c0344e04dde78c0faa091
SHA512 e453d5d999506b1af32a0251b503f19715f313d3b3ee7d0fd96bdc49d3ccabf50f9aa8e12c1ec4e6d8c5084a51ac86d4a507fb75bc89f352a17c955a40475f50
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStay0:A3kMP56r0
TLSH
T12D157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 858KB
SHA256 6fe52a6260765d6c63e19811e0e4ad63688bae493b836e9cde744d1d14ac1ff2
MD5 9a68cd92fc568bbcdcbcf755ff98c449
SHA1 4d6a894a1d3eb0ee5822b46a8037e705d846a564
SHA512 2d1d01dcfa92b12eadd76621cf30a51b2a1f2f84e0e95d8ddebf3e3c33b1fdb432e2fa221921c1a67c599d77731111fabb6fa23fb04a304cd85aaf508e369d4d
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaBg:A3kMP56rJ
TLSH
T183157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 858KB
SHA256 682975c5e729cac426b3ecbf21d2081926e14ac90bcdec17a5c36befa24e443a
MD5 133bb9671a1e84bad25221fe4eecbecc
SHA1 e82f8d147b2276a845331abdf9841a33fcb7b34b
SHA512 5ed2d5867e689da1c9a335ab4c820911aa3911449c185756cf788e706c2a1a7ec1167b45c18edfa9b432d738a4cb5a47033465df742fe37c3126d4a42483eb0f
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaor:A3kMP56rz
TLSH
T1AB157B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 858KB
SHA256 de188298f0ec6cc146b8fc25aa3a244e9f237dfcc473fe51d12e5b20cf5bc37c
MD5 e8c92004600a01d9b9b63110d4abe935
SHA1 2f4797de80b5f3f8f97964c07d7e60946292426f
SHA512 3bf0d3a92b5890d220d5517733570177c99872a2131299b85ef88db91dc7f1e9dfadba3bd9ffe6ff02a49dafe1ac52dfb3ab8eb269db03c0bba60fd0a3f2fb62
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaGn:A3kMP56r1
TLSH
T167157B13A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 858KB
SHA256 a9479585a4258ecfef597777651925361f6e820d0989160e02892d3253d09903
MD5 2051d964fc482976833b22c4fa495491
SHA1 48e9d6b696716c05c78335d45c0d9198d918d741
SHA512 edf517a6a5c3f0ed1466a4dbd0197ad58145257123508ce4e0a06df09480c8890075999bc51f7faba07cd2f09b9bf17b15032e54e69c033cd5f85ad9171b1294
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaMx:A3kMP56rL
TLSH
T143157B13A6940FE9D11F817499914662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 858KB
SHA256 66538420e6d24d7dd673cda4c5ddc3f34b89e0523d76391cfee7bf40027da3f1
MD5 7c4aa600a5a1401e461787f3a6e2bd36
SHA1 6a48d8e5e204e8c894fe5e247d362faeabc7e3a6
SHA512 bba0603d3735574e20eaab797bfe005426e63b3b73dc6e5bd3b7d06e5ef245a2abfca42fd641a4d1f19bda965ea6dced5538630babd36330b5c0192ed51d7675
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaGA:A3kMP56rk
TLSH
T146157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 858KB
SHA256 03e108ab452241ee165276609a5b1c8703e6b7586d805fdc68660c8d09666a8f
MD5 afdf784e07c7f3bd3eec7392e96f614d
SHA1 1cd35ca546d32bbd859ff6ccaf4cb4c33ffa074e
SHA512 eaa4480af9c913fed239af97af28c4b1e473362d7dcbaf16be209d9cbf9b401ce3bbba836e4232a67439be4904359415537cd56300c0c6d41b19aed598cd44a8
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaf9Q:A3kMP56rV
TLSH
T156157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 858KB
SHA256 c41f9f5c47d22a5592179dc75bcffcca95d9f4f7b8ea169612b7142c2f6ee4ef
MD5 0165240e4b29031ec55bf63518e72536
SHA1 6dc7136f2fcbc54392748e0419171ffe80185284
SHA512 966ec05b464223bd3f3bece26d87885a19ddc159dd3bf7968f6262ce47a260f44e4c06c31c99ced0306402263d02931765631da8527dc4315e89093c5b459044
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaW4:A3kMP56rq
TLSH
T1FE157B07A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 858KB
SHA256 d0ff8b152752d6ccc9e0be0c6b09d7c38396c1485b0a52951e19c58a7545c152
MD5 ff50065ae9cec29adcdb30f1e3d39df5
SHA1 039c49fa524f5019f33f9bab9c6717b31b8c2078
SHA512 048f63ebe055e022e8e8a3dccd6b01b47e537c006616d443754ce50e5b0d999632ed7de97ba1cffb412a140156d4fc60f6381191ffa46e5d284517cfa177ef3e
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaFu:A3kMP56rr
TLSH
T111157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 858KB
SHA256 3b2528650b9cbfb1aa4335d9b7bddafaed41a81fbb3850ccc05c454749c1c2d0
MD5 73f3405425ddd1998a3928d0d7bb4939
SHA1 c46ca1ece1b59d2487a08f9c78ff24c965fc1a94
SHA512 dd3e563ef61e654eaddf866980b63c5d320c4edaea418adb7437214b7e7e585aecb3c4b2785ca477094841971bc2273485ec4bbe02d2f09ac3dd3d6cee8b3b83
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaYj:A3kMP56r1
TLSH
T1C7157B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 858KB
SHA256 93583c159d9ab4be512a07ed18cdaa26ebe784ba28ef69f16adb556ea37cf42a
MD5 822335e3e113e43f062745e2e5cbaffd
SHA1 2f9f357b44da8f3f37b1f27baf1d346496beabdc
SHA512 1bb6ed3b386f641d7858753240e75bfe9902c8efd88fc0c62b33c8d5fdcff65512301af645e1f8a0578f6f40ea90024e408206dae79dbdffda167612863e5ee0
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStapg:A3kMP56rp
TLSH
T1FC157B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 858KB
SHA256 cc21ffe35190c49ae3dca36e867ecee505eb83203520b01a9d2f8f44b3f72f9f
MD5 025756a03d41224c1148643d97b4e8df
SHA1 061014ff7b96bde3a3dd295c5e9f5aa85db0a6b7
SHA512 7855312030cb5166f12324386c579a40cfa676913fd3b94275e7adc844a8f088fdba17546cfbd737314617c2fd4c46ecce01014228b8b5f756ca69dc92469386
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStawI:A3kMP56rI
TLSH
T189157B07A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 858KB
SHA256 1bee1790adaced9bfb4a91a3a44e960776e3e4a8b2c3113fe0ea08e48baf78a8
MD5 0a51418a6b73d2f54774620638519d97
SHA1 874e026cb664084868f257d4b48006e9614c0cbf
SHA512 c8e7bbf19b63ea130eec63d6e098a6eb996db3d267f459b46ae451b5b017721eea7135d7162ec987a891b71ffdcb3b7340979a81d602fd2327797570a1c54f1f
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStayo:A3kMP56r6
TLSH
T1C3157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 858KB
SHA256 877c148bfbb1423c4e43e8bd5c259f197b6e98440988ce21c6f2fdebf4e9e89d
MD5 966b2963650dddc1b8e1173c1511fc04
SHA1 6c8a95189d3564977ffd0a5258b841050a8097a9
SHA512 337189cb3bff8ba1a6da03c2178faa5abc7097e25885f5b52ab3709b95c2529084a050898d0fea9e3c528b7af4fc3185049d74aea217f3557c52886ea3acd132
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStap+:A3kMP56rf
TLSH
T184157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 858KB
SHA256 e948b470b6b00d4d53d4564109cd4beeecfbec6ae47d484d323e3fca8d06ad57
MD5 730313687aaad00891e8181e8f10ccdd
SHA1 14cfa0d5b6589d381bb12c2fbeee45b61ce24223
SHA512 c8e122bb588580e3292a0558344f6e2e186870e87896ad43d1b699610d684743a6439a2e568706ec1c4c8117ed4c7309c3f9779a0f9353026e17f4001d4a8076
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaXQ:A3kMP56r7
TLSH
T18E157B07A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 858KB
SHA256 20c242eefa6ddfd2fbb1b8410c3ee84d723b25bf9a053fe7e25e7be9ebbc1d0e
MD5 337a58c4411808677d931dce42b7ad53
SHA1 b517a6d75f6ef871fc8c399721a553d3102843b5
SHA512 620e4b6568b872442c6a1fee5e306f33c488455867918ef34f5ced6e9d5ad0ee3040e1793a22bcfc9c08d9c44de641983c5dc017a7a3035f18599c0b04f80f0c
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStasX:A3kMP56rP
TLSH
T172157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 858KB
SHA256 ffca182995b3cf9152bdbcb3e56b6acc7bd023d420a088157ddd39cd75df1145
MD5 a4d6259b1d1ac4d49d88579ba36de536
SHA1 03915091d3688c157604e0f4a6a73d47e97b57f5
SHA512 e99cb5d86d34c912637ac58f1a7b3536c7cf92190ea052851ddbb8e3508a2589175a392f0ed4f9c2adbba0968f63bb7411770f4be81974c0ce953fdd106b1a89
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStaKL:A3kMP56rh
TLSH
T1D4157B13A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 858KB
SHA256 0c4d0c03517aa779fc32dbb0852f10cf1f731974735a30474b7983e985218c54
MD5 4e1026933ae4503a64c0c5d300cb7d62
SHA1 f8787cf046f180279d118f54e18732be02395a5c
SHA512 53380e804235507ed0b68482165ab09277fa8742b286f889da284dfe3c2708d64695c373eadbfce14a8779803ca559681ff96d3500a4de726791a850a60a78cf
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxStauM:A3kMP56r4
TLSH
T111157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 858KB
SHA256 fcef8b7d685d382cf00b6791a6a2c6dd629b5f1bbb9a665e7085f60a697a15f5
MD5 29a2e80466bc225a30a19be75b238b53
SHA1 f9df204fa5039c0b07e51963ff2ef9bf1bf3bd34
SHA512 a6d1b086387fa6b02a2c43e8e5b61ade381079d1df029e9dfa9dd24a05887e899f4c7fd6fae8bac43ff5673dc00e689711d86b27b5831a42bdd3cfbeacc5926b
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxSta3h:A3kMP56rq
TLSH
T13D157B13A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3036-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3036-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5356-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads