d17153a6804877f423258ab321a703f937aec352e3e852946a56d0260b58a26b

Analysis

max time kernel
103s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 07:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_19319410178dfa81913db75808f73bca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 888KB
Sample260727-hvxkbaxfpg
SHA256 d17153a6804877f423258ab321a703f937aec352e3e852946a56d0260b58a26b
MD5 19319410178dfa81913db75808f73bca
SHA1 e10e6c00ca7553f1f19f054462594a1590c383a1
SHA512 e06a60159d49eb9969f07853a197637a1c26564cf2cb051d39172b49b71ab9c5b157085badf0ca5369beb2cd922495862484ae04f51c3339ada890ed7eb58367
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFok:A3mnXoZjzyaEFoM3mnXoZjzyaEFok
TLSH
T13F159E17E79110F9D11AC1748AA65A22F771BC2217309ADF236486263F73BD0AF3E764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5204-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c523-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5204-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/940-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-564.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-650.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-760.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-798.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-912.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1130.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c523-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-260.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-491.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-564.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-650.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-760.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-798.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-912.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1042.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1080.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1130.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1149.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1218.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1327.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1380.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
940	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-27_19319410178dfa81913db75808f73bca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-27_19319410178dfa81913db75808f73bca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-07-27_19319410178dfa81913db75808f73bca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-27_19319410178dfa81913db75808f73bca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-07-27_19319410178dfa81913db75808f73bca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-27_19319410178dfa81913db75808f73bca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-27_19319410178dfa81913db75808f73bca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-27_19319410178dfa81913db75808f73bca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-27_19319410178dfa81913db75808f73bca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-27_19319410178dfa81913db75808f73bca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-27_19319410178dfa81913db75808f73bca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-27_19319410178dfa81913db75808f73bca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-27_19319410178dfa81913db75808f73bca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_19319410178dfa81913db75808f73bca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-27_19319410178dfa81913db75808f73bca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5204	2026-07-27_19319410178dfa81913db75808f73bca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
940	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-27_19319410178dfa81913db75808f73bca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_19319410178dfa81913db75808f73bca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5204

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 888KB
SHA256 d17153a6804877f423258ab321a703f937aec352e3e852946a56d0260b58a26b
MD5 19319410178dfa81913db75808f73bca
SHA1 e10e6c00ca7553f1f19f054462594a1590c383a1
SHA512 e06a60159d49eb9969f07853a197637a1c26564cf2cb051d39172b49b71ab9c5b157085badf0ca5369beb2cd922495862484ae04f51c3339ada890ed7eb58367
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFok:A3mnXoZjzyaEFoM3mnXoZjzyaEFok
TLSH
T13F159E17E79110F9D11AC1748AA65A22F771BC2217309ADF236486263F73BD0AF3E764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 9cf8c48d9945fed7fff41b8fd8d7141f3cd1cf3d2eb3993b5d1414292c590241
MD5 015549d0d6407dbcbf1cfeb1ce645dc1
SHA1 2ddf55ad3e72a6b03a25e0aad621ba8b8d2f3921
SHA512 f8fca21d0f7c3aaadb328fe4824a6b5b85827e50000ed851bf34d55ae27cdea5508f0a5bd136c496b03fa9fbee45599629781f0a4a10c9a539065a325724a800
SSDEEP 24576:A3mnXoZjzyaEFoM3mnXoZjzyaEFot0Le5ji0hmxNrM:A3kMG3kMDPji0Aj
TLSH
T149656B17F6A402B5D026C179C9D2AA5AFB71385217308ACF1394C7293F27BE19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 903KB
SHA256 f02083f46d7aad817c58dc909b245182f6773dc4a3853968c82f9eaf3fec5537
MD5 e0db6c8959925f56855a077e9dceb490
SHA1 e01e42479102021d026cdfa7942626f92a82efb0
SHA512 0ba580b7342a4431977a3155d2d40b71649c9e2fbd31c4c656c5b19c69345dbd2651429d056334de77b5b13e93aa8683e7ac2dd6a386f8b5929d407b7fa2bf0d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFo/a:A3mnXoZjzyaEFoM3mnXoZjzyaEFo/a
TLSH
T1F6159D17E79110F9D11AC1348AA65A22F771BC2217309ADF236496263F73BD0AF3E764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 912KB
SHA256 b6e58c1622e64a532e4b283b85fbe155a117d2d36a41f838e79e8eb589f98c79
MD5 2dc0cd1cd5dbf459d0f9ccd5dc6197f6
SHA1 bb68924098ba599ce9bc07259b8334fc7e2101c7
SHA512 a452b97ea5c6c6e791fce32b06a4c436b470ec3dcfc17c9a45ca3ca4d3e306b06cd8e18d3643abe4af0292b7a441dd1bc2ef302175946995f131be8bb68f0328
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoe6:A3mnXoZjzyaEFoM3mnXoZjzyaEFoe6
TLSH
T1F815AE17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 912KB
SHA256 731e416d9daa87c47b73369ebef0e45b6b757a3d13404957de3bf5d8e9e800ed
MD5 a41b5dc9a494c4b65bb5d77af0d76e3c
SHA1 cad0a62d18684b913d34a4e9b24bae5f4dd3653f
SHA512 a074243cf3749bef8342af4e5c7a32c4da000992d0539ae0b9d0ed46a8cf919a1d1a56d98588605e65a592141a9ff0c7d7d42ae5820580bfb1f8068c874adebd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoON:A3mnXoZjzyaEFoM3mnXoZjzyaEFoON
TLSH
T15E15AE17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 912KB
SHA256 c8f8212d67989776f4372e7d8158c2fa2f59d3bc5238cd43816ff77687dcc23d
MD5 0ce301defd6f3d08dbf082bbed3fc0f4
SHA1 fe5bedc592c319b55db7f47792d501f12c4a02a4
SHA512 86b3badf181ca00cfda247c7577baa13d0d4a643dff4d06e19c3852750cd1f5c278b1a6e2e0b730fcb4bb6172259745515e8f46b65654593dba5021199684a89
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFocf:A3mnXoZjzyaEFoM3mnXoZjzyaEFocf
TLSH
T123159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 912KB
SHA256 d1eaa7138060e4925745173a7f0a3d1d97f3782a565dd0d3de55277073529166
MD5 6d137f79d0eceb8e575a86fcc2830a5a
SHA1 41480b4b881933797fcbf9c21efd0b98597fa968
SHA512 b3550913a3a1fadefac35eaa341a05b0b43046087914b492b1995f0d1dc7e82c5f08a2f7a683abe9a7e83d896a7930d6192fb990ef384f59848685ce8042c0d0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFomo:A3mnXoZjzyaEFoM3mnXoZjzyaEFomo
TLSH
T1DF15AE17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 912KB
SHA256 fc25ab2c2d3377c8375cc55e960cb92299308f9af55cc356c9b9a4056b110883
MD5 eaf46f9f8cd99c465a4a243b19ac4fc9
SHA1 0529141901c8bcf9d428e6a9e9db36927d237e8b
SHA512 d84c102c0f849f48f787a7e1d85bd4504d533092a729b5f99cb306b7ee091d13fec61ab90d7f0ba9a3bd9753b91319b5ac9384089b3f6bc9f5aea48fced3cfa5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoau:A3mnXoZjzyaEFoM3mnXoZjzyaEFoau
TLSH
T12B159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 912KB
SHA256 75a40abcd5d04691bf5f11e41788fdc5c00541ff134eea4f60273cc1a2c7a6b2
MD5 48c443156fc42bad870412264e01b81a
SHA1 5fbc8bcdb12cd330edbc4ced5b33c2de2be6bd8d
SHA512 6cb590d73928ca70dccb9548c72c695e569d4fe5bd55c149e768d3689de1a98e3e903d64abad0ca6af181d9a86b8f5ee781016acabefbe03a33426213a5ba58d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFou9:A3mnXoZjzyaEFoM3mnXoZjzyaEFou9
TLSH
T1FB159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 912KB
SHA256 4403941bc05109892d18b3bb5dd90300d68aced0bf31a145c72e565929ef2e88
MD5 2ec86ba11d5c2a5d6b5ebda308904644
SHA1 a5dee6a125d73d89b818c0305b3faa9c3a5c95b7
SHA512 6bacc97451d213e24cec2d1b83b3a135f9d531b32942e6e691e3afffcb7ced76ec104b898a69cf43abc0f5ddbb2196abe841cf1336307cdafbd1a736a6d1166b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFouc:A3mnXoZjzyaEFoM3mnXoZjzyaEFouc
TLSH
T158159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 912KB
SHA256 2db2535d297e74bf2013f357baddcf1aef4a887b382df3cc381f98c3aabfa088
MD5 a5c3c664442c0e696bc1a7e229ce8aee
SHA1 4eb23f5b9b94d6be9848a0d12b97d2e94f7a8756
SHA512 7bcd4936a380946eb63c72203e0c01b3a843ce3b71af32391f1b0aa02d764ad0ddb3dd1518f611fccba71823e05131e2270179386693df6efa111cd26459d610
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFo3p:A3mnXoZjzyaEFoM3mnXoZjzyaEFo3p
TLSH
T1B4159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 912KB
SHA256 dbb9387cff6837a6da6eb1284ba70dce94bc628a1deeb6df9235a67678770e95
MD5 3eddf2dee0574cb8b40b42f4d8a8d2ca
SHA1 c1eb77e51a3680a406a27b5f4b5fb7ee7d8c2621
SHA512 4daa4a11d84aafc12136bfaa7a309f6f67ffc4c2b374fd992b72923f43f040bbe16fa9163fc09ab89e1e3dfc31a73a2d6ac8ca3111609dd444c66e3a370acf3c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoo0a:A3mnXoZjzyaEFoM3mnXoZjzyaEFooN
TLSH
T1EC159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 912KB
SHA256 b6e21b2a2bd2282d26049707efab28f676c39ed6408d892fab85e21e74065f72
MD5 578b541d866d4399292249157f1e091f
SHA1 e3f63bbab05df907dff077205bf2b4976ea8e96d
SHA512 d417640f1765dd19ade7e8bf14044d9024d2ee67c607037a41614c76da66f338e2296fff4ed78c1d974a2b61fc5d78188c2cd28d7f799a6570b0e4505ed3db9d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFowF:A3mnXoZjzyaEFoM3mnXoZjzyaEFowF
TLSH
T16F159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 912KB
SHA256 c09df5e3a9cbd8aa5449927e0116af4efdb2a3e7addde18761fcfddf94892b61
MD5 d05cef638c5d3ad0d07445a810f9af3b
SHA1 e8d4d2345c2492becbea481548cb8b4751cd3192
SHA512 d6bfa19644a38539f23b3160c99989d17903e500ea2f80cc6c67c75526b68ddcba358d64cfa9bcc1c551d693055a9d26020007fea94331ffae117cb4597ac7dd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoVC:A3mnXoZjzyaEFoM3mnXoZjzyaEFoVC
TLSH
T163159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 912KB
SHA256 8e4270a08b627fec0221e9a23dead5d73374f6e6970836c1bcffadc4b73d05c0
MD5 bc6d3e9d17204dbde36491ac9da25078
SHA1 57bfd56f730a6d0ee5c34ce7bdc151485dc8d2d3
SHA512 f723e749a8140ce28816f00c13f6e21fdc9282843f6f8532f18d306b720d1784d06790806be37d4e1322219b417fce378bc44992ffc242805cb9d2f78429a294
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoew:A3mnXoZjzyaEFoM3mnXoZjzyaEFoew
TLSH
T177159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 912KB
SHA256 547ebce289a04cdefb0cced42e8c7499381f5b1385a6a70b1a53243c25d4624c
MD5 20d7ccb289a914c06e99eaa20b58f2e9
SHA1 83da3bc4f5b605f4d085e8f958df6e7371886875
SHA512 7752dc2b218db1eceafd276f501dc7fe0a2cec9b4bbf545f9dcfb378f0336ccf7200a3b66b34187c7973e498b7dd68c2f25a5437438b1bb9d2db52c3f13789aa
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoNT:A3mnXoZjzyaEFoM3mnXoZjzyaEFoNT
TLSH
T1DD159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 912KB
SHA256 f8ee253efcf25926904d6055d44c9fa3666bf25918acbba3b3c69a2e2e60f794
MD5 535ce01b18ccef3603b944b84e6301f7
SHA1 7211959c1b3870f15a663b6706d0c084d537e477
SHA512 329a107bb6788cb468ca20fd48d9209e7056bc44469b35816b4e88d9bfc1a31c3e8b0229f112ea7194aefcad97802939b8e6a1bf962125117a6032c95b54d8d2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoTu:A3mnXoZjzyaEFoM3mnXoZjzyaEFoTu
TLSH
T106159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 912KB
SHA256 909c88afe4e6302dd01c018ec2ed1bb2940b1c3b28f0471e24b8203b2c98542b
MD5 2c98d8d87fc6769a06794ad5d5cb6900
SHA1 23cc31dbfcda04efcfe22cb23d4db8f49dc4b06a
SHA512 eb8c57ea821d4bc3a1b35af4bb22d2ba115025f29608ceb5e7e3ea3ef46e239484ee16df2f7a624d6372df1280c05e8843949cc8b79ad082f82a130a2d071181
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoHb:A3mnXoZjzyaEFoM3mnXoZjzyaEFoHb
TLSH
T1D8159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 912KB
SHA256 fd9130f75192628f9f3ac2c58e9b27e57fb3cea8243157414e9e8cacb49e8445
MD5 8217fef5a9430a00e1d49baf82d53265
SHA1 0d52543823d631712332d13bf0803f93e23982f4
SHA512 518f3510b09b100f201af9a1770b8ae69551886bf30246a2051fb7cadabd41f799d5d1ca128e14f296d2318be6e475ba3e3135fc1b3ac53e0081ef2f183689c3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoDf:A3mnXoZjzyaEFoM3mnXoZjzyaEFoDf
TLSH
T156159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 912KB
SHA256 4a494a7c5603fd133a92613d3a050457ccba1eb9e2b7b3a33e67032cfd9d3cde
MD5 7c4566d716f29adb75f0b1e7ce59529f
SHA1 490a5ee24f4858c1743e162abe981affb30151dc
SHA512 976faf75d190960bf6a86458cb774d4a97a95eb8f3aa97f059d17d534d3684778eec7b319f46856e30a544317e2790c48e6c73066bfb05e1c3fbda700142b40d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFo8K:A3mnXoZjzyaEFoM3mnXoZjzyaEFo8K
TLSH
T145159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 912KB
SHA256 54313907625f8c478e79ba522066bba873c4df2387d6f4c5efc290e7f326a250
MD5 98af8a3355cde2f5b2813d0f5a513e9e
SHA1 7db45e0daccb3535c4f119f3d2b2ab45d5c03f88
SHA512 5e10ba82a0520b4f3a998bbcf2db5fdf6b04ed1c89bab2dc5e85c9baba22c71eca20a9aacbef4723942cb458cd13a70b87e55d4429b1119d6523aae6097b98cb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoBk:A3mnXoZjzyaEFoM3mnXoZjzyaEFoBk
TLSH
T1F5159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 912KB
SHA256 98ed2992f6913c3807c77cb9dee91cdb2a0c4858e8aff9bdac65076ff7eee988
MD5 e339bfc53e15da922cbd2e8fed166237
SHA1 43f6eb26a50c06476c2528a44a06dcda7f45a47d
SHA512 d486e6d77f8d752502e7f2f12480b72fcb95ddf13219a85a27506f5f4bec57729740d70a74c9699ef0c96cb0bbf3eec1936d6f36ba2a40b5bb3ea96ee2127889
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoO0:A3mnXoZjzyaEFoM3mnXoZjzyaEFoO0
TLSH
T1AC15AE17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 912KB
SHA256 58fe9d00603bb13c73bbb1519468de57ee27b6d30b06a333945578473e7c716f
MD5 6a85f14af6fbc805b2e419e1ea2b378b
SHA1 b77e2a34ec0d270c64d028733d30a196e566f305
SHA512 198640661fe108d0f02eef88b1e4078821dbf4005c9b6c7920bae4889262c6083476d64c80692e9b058d81007d251ca155473fe48aab45082d246820272c6074
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFod70:A3mnXoZjzyaEFoM3mnXoZjzyaEFodg
TLSH
T102159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 912KB
SHA256 cee0d85c66ca8c356e48df872a5c08c16dd9ff02185554719e1a13133894fe76
MD5 05ca18f80dee49290304f99cb46ea318
SHA1 312839fd4d6395fb828b71a77f3c48b5697d6437
SHA512 76107222aef11644bab03898e5a70cc67e49e014c5664bac25861941f4cfb1db69933c678a6835f96d60d2ce70fc5980b4c656f7041289121d7b903e73161d02
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoMr:A3mnXoZjzyaEFoM3mnXoZjzyaEFoMr
TLSH
T164159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 912KB
SHA256 3ade6e527165b325de7855d758650632bc77410fec97987d1cb870004e45ad94
MD5 b1dd19922f15e44831e16e32024609a5
SHA1 51f62087f8d4c450fd8dbcfdf11a729c4e7aeef1
SHA512 ae3264f88acf3d0b6c968d1116a6423bccd3562db55235254ede809ea44b9438fb80bd93589c1125dbe8dbdad60b5c5a6f811863d9d5cdf107fddbc96d9ab875
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoCn:A3mnXoZjzyaEFoM3mnXoZjzyaEFoCn
TLSH
T1B1159E13E79110F9D11AC1748AA65A22F771BC26173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 912KB
SHA256 f84017a94c45a18de424be482773b2d3a66d8327abe62de35291100f9a9bacd1
MD5 91252149c1b97f373bfe1adc1facb1bc
SHA1 b62bccb61be43567453da270d4e9faa13473b943
SHA512 20188803e1d6b0e2c36cbc33d5402cf5bc1bb4cc256b70334cabb77c80cb2ca5a36b8e55623ff24cd28c67c10a71424865c41c8c3d17da4a36a97840c64f92e7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoox:A3mnXoZjzyaEFoM3mnXoZjzyaEFoox
TLSH
T117159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 912KB
SHA256 40c1269b0aa8fe2cff5e208678e7190a7ad8b0f4dfd246f58eaaa7071692c264
MD5 c76558f3888e1e3422d174ca2c343864
SHA1 2c105c43b43c763ffb744b4005db066468df9ada
SHA512 478bc7c64d285c58deaddbc3a2d762376abfbf2260c40a644b95b04d12dc5ca0baa3a765b27ea78b2c2f9051756113c0f84fa1cf2a5e125813417b484ffab724
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoaA:A3mnXoZjzyaEFoM3mnXoZjzyaEFoaA
TLSH
T12E159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 912KB
SHA256 d9ca5de1ae6953859ee28f81d829f50499dcce5556361ef9ffc1de080cec319c
MD5 145a692394b4eb0a3add4397702958cd
SHA1 e2141a0e0658f7341b82e1dd812fb7a878a64029
SHA512 16de0d84ba95177a0198265b8c3478fd8dd7870888ab64b89fb36fed391bc4bdd0249a117fc35805f9a89574b079571073dd89ef15c6015fd03281cd30e2025f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoT9Q:A3mnXoZjzyaEFoM3mnXoZjzyaEFoT9Q
TLSH
T1C5159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 912KB
SHA256 22ac83421bd8c1e2a6dfd296b49ddc48301086d4cc1425755c1526fd28064c65
MD5 26242e53e0032a84f4ae5d9bf5a5276d
SHA1 f5213d1dcf1fc0ed6fe958a1eabc56b3e74f34e3
SHA512 ebfe7fc95ddc9a8a316e2ae0cae595a4b8cad506b62d4cf4b32113819d0c675abfb15075145efa3eda79091b214803251322f87854690e80859a1787774d6e4b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoS4:A3mnXoZjzyaEFoM3mnXoZjzyaEFoS4
TLSH
T18F159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 912KB
SHA256 c421efc46bfad28acd91e944d42939f02cce84c3101bcd5be7f10df9ef3961af
MD5 bbb92c38a5cd3dd8df3d04b58f2ae1c8
SHA1 490f75b9abc57d09a8592f3711d29f23967f0a5f
SHA512 405f7e33fb7e984859a4756a05fe8698999a189e01c7d44f11e620e9060921a2fe1277a2f3dddefcbe5fb885ffb331e22d31598fe3f3ce5bc8783ec7282b19da
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoJu:A3mnXoZjzyaEFoM3mnXoZjzyaEFoJu
TLSH
T191159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 912KB
SHA256 d531e0816562cb775efd41926680560f722e5d35852d8a2b3dc9cad4540cf418
MD5 b10ae55cbd97254b50b2ef4da777e359
SHA1 15ec581d369d5bc374ec42363d51008a041192e9
SHA512 8f56092c16e182b3bf832536ad310bfd7ad0dd029d97b811f1dfdc97eedfc5ec67345a2b3f2cbd9157943f9cf33a22c22da4d4ace857e1cfc3f0bde56208d67d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFo8j:A3mnXoZjzyaEFoM3mnXoZjzyaEFo8j
TLSH
T158159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 912KB
SHA256 8c26781a2060ffe074bb5514cd88f80be10aef201f6544ebb316f3a53a8e9406
MD5 e1c5dd113b0f5f06844e41f1e80e1e08
SHA1 99d7347f406e9b5b9be2ec1bc7ae4950a68ef526
SHA512 888ea0ffb09b139cb9fd59952aa62f94e68e3527258bcd5c10456e9b6e6de1e2d484eb80e13676f4839899ef5b50c5532b04f21d802fc8d62def4683868e7c7f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFodg:A3mnXoZjzyaEFoM3mnXoZjzyaEFodg
TLSH
T1FD15AE13E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 912KB
SHA256 c115f22b62972ceddf628438a4d290ef34d370634575fdf06a21a787ce523941
MD5 548a1eb3555d148db8d2c859451132a2
SHA1 2cd60e579f60a7bfbb0df0683c5a38613b98b5c9
SHA512 7aed692d2c0c5acdbdc769238319a8988203aa52fa434a2a69a75214b4382a5ba18240a2c6e7fa475690219ceb260606dcf2cf5dacf1f1e31779200ea0e5e2f0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFosI:A3mnXoZjzyaEFoM3mnXoZjzyaEFosI
TLSH
T144159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 912KB
SHA256 a4b3e9945a0bb873be46fafef0d0b796e246e86ed392e05fc0c7d34de0d0d516
MD5 4e13028d03c1321db309a558c534d168
SHA1 0cda4a7e65d912cd4f5d1d824ee8190af8974a47
SHA512 c4fefc363dff07aab0a0c4e66a986ff4e37a95cc87881015c79dc65d734c56b79baff105b96cf86697487ea694bb9bb96b573766098493a048e8c2daa35b1522
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoeo:A3mnXoZjzyaEFoM3mnXoZjzyaEFoeo
TLSH
T14D159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 912KB
SHA256 4dd7923d926859cf64e8964c6f2a96fcb21558dd236458f69b5ced64ed4060c2
MD5 c31cd364d07020eca8935b0afb4eca67
SHA1 5c90ada8feb4fea6580b2cfe416c6947e10a17cc
SHA512 2a8f5f3f46e1a189c1e52b493b56d96af03aaf83d93416225b40017499ca7016fef865fa4d527418bc2a0545ca9fcb6a53cf0f067ae870116e0debb79d0ece48
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFol+:A3mnXoZjzyaEFoM3mnXoZjzyaEFol+
TLSH
T1A2159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 912KB
SHA256 12b6b2bca760dcef241e46642d1c4f673e786f7fcdf9cdae0d93883cb65b4285
MD5 a7052712ed1f1d63a017f2e85f6aa4bd
SHA1 6eacf9dd4a328828ed4f213e08870bcfc0df58d6
SHA512 38f729389d28fa4df9a96a98de4dc74de051a7a691a549913c2806ae22b7f22f95ade10b99b513404c0731f88a2ec6e92a881f2618996a5f5338e2a7be9c6934
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFozQ:A3mnXoZjzyaEFoM3mnXoZjzyaEFozQ
TLSH
T1F1159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 912KB
SHA256 5782c3af3bc740d20362aefc1e6372bdad91282a9b29bf66dbe4d393c2367a2a
MD5 2c3d6123e91f3ec76d71bab618c1e225
SHA1 79dc670d8f0e9214af8b57be2c221edda160173d
SHA512 dc2c8ee4e951fe194cceedfc87f850828d501ca0c46ea9f560521c1860bf3e3a9d361e0416be2f5e95b27ccf499f9c33460bbde2d37143f3895f5901d88f1b18
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoYX:A3mnXoZjzyaEFoM3mnXoZjzyaEFoYX
TLSH
T1CC159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 912KB
SHA256 8436966c2bca8ae51073d3b6596f10ac5f3f56b1acdac564e2c3294f46a17570
MD5 d6222721ad20132152e3a0ed5bade422
SHA1 c13ce2388196029e5fff4f273683876d09e238c5
SHA512 484a509d7374bf9b24e3c8b770bbe1f5defaba0e4438fe76a3159ef5ca57365677af69181fc5689342841cec593b9d8da8776383009df9d7ffc6fd2e54786691
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoOL:A3mnXoZjzyaEFoM3mnXoZjzyaEFoOL
TLSH
T1B9159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 912KB
SHA256 a370a47515154b63d2696f24fb69eca9fa770a2e8e5e4b91e11e8d127d8a6628
MD5 282433d1d36f34ef83530587ddaefe07
SHA1 70f6b02550d3b979300f574eb90139c3f80329eb
SHA512 f5f66545dee10d09434a82eeb2ccdb0c8d908e91799ea333f273c17901f0e2c80c67eff58dcf0c4f7702ec22cde61291cfced9ba15fa141381a37c954c3d407a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFoCFC:A3mnXoZjzyaEFoM3mnXoZjzyaEFoCM
TLSH
T1E7159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 912KB
SHA256 2294673754d50577dc4b1c131f0ed46f8aeaf837f4f54cc8395ae9067e6d9f39
MD5 848689c2dcfe0a7f6053f58cdf236075
SHA1 f80b97cbccf8c8dd4f24e8a1acb1cc033c061115
SHA512 fe957e71ab882fed6fc5703e31067542f21b32e1766dda28da879ace68549830e433ff64692df0ba2d37c42280a55147bf714cc3abb93e49562dade79ff42ad4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoM3ZUnXoZ+yPz5L8aEFozh:A3mnXoZjzyaEFoM3mnXoZjzyaEFozh
TLSH
T18D159E17E79110F9D11AC1748AA65A22F771BC22173096DF236486263F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/940-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5204-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5204-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads