d1fbb2e079adf628a8073301883ce65ba6d2bd3c03e290ed0c9422a831830ba3

Analysis

max time kernel
107s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_c04d1007689d888058424ce8b2fdc9a7_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Size 948KB
Sample260728-vecanaad26
SHA256 d1fbb2e079adf628a8073301883ce65ba6d2bd3c03e290ed0c9422a831830ba3
MD5 c04d1007689d888058424ce8b2fdc9a7
SHA1 c877bfd0374024fd4e6c8dc8b34d69b6b5dd2e2c
SHA512 1c87dd6ace0df9a0c6671eab1013ddc380ec0d863bdc1456ccb02eb7dc36e2b346ce7527882a7bf0b392818a0a3dbf7bba653d6fc2ae2aa98c8db4cdacd02a87
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0a:A3mnXoZjzyaT4aewsAjxTcgG6mRN
TLSH
T12525B023FBB090B5D23B49705BA58712EB787D210B6056CBE36C86592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5684-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c52a-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5684-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4648-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-223.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-570.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-699.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-737.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-792.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1194.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1334.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c52a-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-223.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-570.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-699.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-737.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-792.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-932.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1080.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1135.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1166.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1194.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1321.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1334.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1365.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1372.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1379.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4648	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-28_c04d1007689d888058424ce8b2fdc9a7_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-28_c04d1007689d888058424ce8b2fdc9a7_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-28_c04d1007689d888058424ce8b2fdc9a7_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-28_c04d1007689d888058424ce8b2fdc9a7_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	2026-07-28_c04d1007689d888058424ce8b2fdc9a7_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-28_c04d1007689d888058424ce8b2fdc9a7_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-28_c04d1007689d888058424ce8b2fdc9a7_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-07-28_c04d1007689d888058424ce8b2fdc9a7_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-07-28_c04d1007689d888058424ce8b2fdc9a7_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{9A8DEEB6-1F0A-4CF4-BD83-A8EC662094A8}\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-28_c04d1007689d888058424ce8b2fdc9a7_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-28_c04d1007689d888058424ce8b2fdc9a7_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_c04d1007689d888058424ce8b2fdc9a7_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-28_c04d1007689d888058424ce8b2fdc9a7_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5684	2026-07-28_c04d1007689d888058424ce8b2fdc9a7_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
4648	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-28_c04d1007689d888058424ce8b2fdc9a7_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_c04d1007689d888058424ce8b2fdc9a7_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5684

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 948KB
SHA256 d1fbb2e079adf628a8073301883ce65ba6d2bd3c03e290ed0c9422a831830ba3
MD5 c04d1007689d888058424ce8b2fdc9a7
SHA1 c877bfd0374024fd4e6c8dc8b34d69b6b5dd2e2c
SHA512 1c87dd6ace0df9a0c6671eab1013ddc380ec0d863bdc1456ccb02eb7dc36e2b346ce7527882a7bf0b392818a0a3dbf7bba653d6fc2ae2aa98c8db4cdacd02a87
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0a:A3mnXoZjzyaT4aewsAjxTcgG6mRN
TLSH
T12525B023FBB090B5D23B49705BA58712EB787D210B6056CBE36C86592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 b9b965f4aa7e3928842c77d8cc698dad632364dfce420a389124cc5415d72873
MD5 fb754a83c7cee7407cecff59e6a548a7
SHA1 b2b00241b32bf74060e5a0bc9ef71efe0668c796
SHA512 0e22de887b87c957220fd34ff417dd9ec15a0db584ad92dcc982facb1cce1cbc055951f6a2d7b60dc41707573f91f2b2cd2585aaee7f713c19b5e002b82668ea
SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTcgG6mRZ0Le5ji0hmxNrM:A3kMPljuPji0Aj
TLSH
T147659E22FA748275D077C4B5C6E2975AEA7534520B308ACB9398C76C2F237D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 963KB
SHA256 d4e6eaefdb6f9b4c966bd9c408dc1c8ef3221e55d163ab1e1b779595dcedb962
MD5 6809950b2cbc6be20faae950c998ba34
SHA1 2d282de5df7993c494a4360bee9eddca745575f9
SHA512 65f00e225dd47e8ffdf23754d401e37d0a87b545c801352029d2c9a7af1c2fb83d53916e3353afb334b20be79a217695e3e64352fe24d2129ae2a3bea595f275
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0ka:A3mnXoZjzyaT4aewsAjxTcgG6mRLa
TLSH
T1CF25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 972KB
SHA256 57ae014d6a9f1d641a002c437f7a8910db7ef8abaab552f4e41aa8fe2e43fe7f
MD5 c1622291177400a5b18cd65acb35757e
SHA1 d3a5b2290306b645f8bea8721cc38766b311517e
SHA512 aca3a1942a307518c3cdef6ef810ba28efd86bb356a871a92b0d3ef7ed17a89c215c27da4b87c9fd80263db5ae62b875b59617363828d9dc04de9369a7a27d78
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0d6:A3mnXoZjzyaT4aewsAjxTcgG6mRK6
TLSH
T1DA25BF23EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 972KB
SHA256 2d1918abdc0313438f0be41736604577e43751b91689368b5f17779762d17673
MD5 54e4cfd72b4f583492b72f1011e80592
SHA1 99ea167dfff35f0e2d5f4ad81909c2d217f32430
SHA512 0b97d373d997286e56015539fd704c36896750ccf04b1da2538243a584ad0e28bedd9cc16ed26bf63522eb6fd215b756fd0a97f761a78569f87e3f2c29d8eea5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0zN:A3mnXoZjzyaT4aewsAjxTcgG6mRiN
TLSH
T19C25BF23EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 972KB
SHA256 0e27063276083c8b5e9a9f032b943619ab9fd188d940624962cc6970d6704ce9
MD5 064a6b4877bf31eb04922b3cba92663c
SHA1 d6d5ca665e0c603004e2fb275576315ce8c6b7c8
SHA512 4feb2d100f62ff85a27249c1b954da50229d0de37a94db8ee083994ca4fd72c72a159bddeb33be480bebb88b143703614654b367d3b109b9720a2184d3781ff8
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0Bf:A3mnXoZjzyaT4aewsAjxTcgG6mRYf
TLSH
T19A25BF23EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 972KB
SHA256 3b1bb563d13da4a398c87c0887f2ff10b993f2beb5b6f1e6f5c15ca1006ee922
MD5 5e0595c2a4d989807662e8cfe5f27648
SHA1 afae63447365191e4eeb83ffc80b251ed8864bd7
SHA512 bcdba03d6c13eb78ec036d5a2846b1ba3f522448d0aa8aceeaf9be2151e2add8f4b5fe88079bfe6ddf1ada31b1bbdd565bbaa0a7424aa3a5bc9ad540c95fa579
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0jo:A3mnXoZjzyaT4aewsAjxTcgG6mRyo
TLSH
T12525B023EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 972KB
SHA256 9f5a5f2091d7579431f443237008d74ce8a9ff48d88921f8d0a868ea32712c4c
MD5 9b4edcc64241adab68fedc49e9d46ba3
SHA1 008e2b6d5b389ed5a36b124971e8d19aa3b366d8
SHA512 2716454224b9ee243057c7cb5add537ee97a6f2b088017e3418ea999c68454f1e39c3f2a780cccb50e3c69818f26f65eac756dd2df98bd45b1cdbee1fd708045
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0Xu:A3mnXoZjzyaT4aewsAjxTcgG6mRmu
TLSH
T1DD25BF23EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 972KB
SHA256 b793c00ac71004a8ab5a565d3ac886a0be2b5a8ca45a3cea0a4ebb67dc7c1221
MD5 284d7f3625a13f8d09386083fd95fcef
SHA1 9cde9b72c6138c08f61a139dffcd6190ae2c82e5
SHA512 36cc197927e217ef4351b084b1949e39f43347a6c04d9a8c97c8526284fe6db1dd0fe5fc05653f7c77aad114cf05f537782e4dc591fed319f5710a9169ed72f2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0l9:A3mnXoZjzyaT4aewsAjxTcgG6mRa9
TLSH
T19725B023EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 972KB
SHA256 a31bd8d9726774a1deaa19524642e5c91a49c0adf55bd1b2c5b3b7dc2a3cade6
MD5 8ed6c1ce0369c2b3cc9b2f74f1a6a570
SHA1 89bb0f23018f9a4554d0eff966f70b0aed1f6c1a
SHA512 06991f0b8b9c73882739fbdc3bb450de22725904075e8b408b23ede4f4fc86ee9f4722144b1ce3371f019828ca5829858dab87180f48b8afb3dd7da91220f460
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0Bc:A3mnXoZjzyaT4aewsAjxTcgG6mRac
TLSH
T12925B023EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 972KB
SHA256 e60d05b596b697473f38435d964a1c8fbc966c297fce5395d9cffe10be463c20
MD5 cb0cd9869bc2ffa5a95f26089df911b9
SHA1 982c3cc547cdf15d764281837a0162f073586a72
SHA512 7474500d3df830a6cfe6b72fd66a3e7d033073312756f60fe653ab68f778638ddf326cb6dfcbe5831376bbcfe8cda5d402e3826ff55ffc489c55e72c3ad17d1c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0qp:A3mnXoZjzyaT4aewsAjxTcgG6mRTp
TLSH
T16C25B023EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 972KB
SHA256 56e4a5c9b8fb54e07b01a5a38431517fdbc03fa8842fc95ecd85dc2a3992f093
MD5 fd6c53fa4a6661becbb209d4553ff6ac
SHA1 a5f6cce7db181cb7b271637d40b6adb627fd2341
SHA512 81b428eabaa614669395f30830bf38132e3daaed5b4326c80bde4d5e281a82c897b15c55a9ab2dcf0dbf6234151c42b5a30fadaccc361a3868b94eed21fe79e6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0N0a:A3mnXoZjzyaT4aewsAjxTcgG6mR0N
TLSH
T13525B023EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 972KB
SHA256 b46bb301a0ca4305cd3839f5f9003e5771a7b60f6d410c991afbbba174a2b554
MD5 9af4336782a84547e5767763fcccf8b9
SHA1 e8acca5a098fe0b4ce2f1a9e5b5236a97ba68562
SHA512 83421729976b685ad966fd7c8241b4c332f51a482506c19f6f00b3b076dd94234eca993c40dd0ac68aad5d7d806419ed0466d5ffbeba657c6a26c995b9397f1c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0/F:A3mnXoZjzyaT4aewsAjxTcgG6mRcF
TLSH
T10F25B023EBB090B5D22B49705BA58712EB787D610B6056CBF36C86192F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 972KB
SHA256 99ac2e26de99a535696ffdfe3c6c46e20a00a7d96b6e28cf6f40fd4bb24bf5fe
MD5 45842872058e5edd315048888ea9f305
SHA1 257bec1f48ac5474e0a5defe08da80e4105fcbe7
SHA512 421615c0b966c25a3ee1f67b79af2a02a8f9d492ec6b90c552d13a0d6c8f8d89cce8dcdb652db1a915c8b680b24705f66be361c3390dd5f6ea11e88ed58a259f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0gC:A3mnXoZjzyaT4aewsAjxTcgG6mRJC
TLSH
T14F25BF23EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 972KB
SHA256 bfaf5e00d95b3cfc2bbf506fdeae4c22e6303c4cb41c43b08e6182379a71a406
MD5 359439335d1fe6e45cc1a55932fd00d0
SHA1 884f31c14e432c17ae03e97d41dae16d72bcf313
SHA512 aef5a619ae24f71ea146ccbe4dd3a6e124d56b63b20f1868d510785b04c87d4cce049b61de5b2b162b3c6a84ce177bfe5469b947f434a1cc0857d82008338a8d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0zw:A3mnXoZjzyaT4aewsAjxTcgG6mRqw
TLSH
T15E25B023EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 972KB
SHA256 b0d15a8e110f13997172099948493a803268e79abcffcd7892c920d756ff63de
MD5 b59c4ca1ecdc8d212705b8ad2fa8ab8d
SHA1 77bb446720f2c89c32362d1300b80ed1adf1a160
SHA512 8218fd64908c68f5d2c3dc0532a3b7481222bb438c816f21ba75c6306e7a4635804e094e8e11152b39ec629b5cedcd90e074b119f290b1d72754361b837aa0f3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR06T:A3mnXoZjzyaT4aewsAjxTcgG6mRxT
TLSH
T16525BF23EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 972KB
SHA256 07377e43a2bf641f8d5c1dfaf4183acf9ebf7ba36151b659c1460a395cc2382a
MD5 cf3a8aac25e9cb501e0a2d1aee57fa7a
SHA1 790aa7c6247cee08f32608f61cb715209535641d
SHA512 a6e31877bbae565703517abc215c6d61971100a08485fc477f9e1381ba2101da5d89129119cdc3d06a7f9f16431620af39bae06da6083c70656076bf35d09746
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0au:A3mnXoZjzyaT4aewsAjxTcgG6mRfu
TLSH
T15825B023EBB090B5D22B49705BA58712EB787D610B6056CBF36C86192F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 972KB
SHA256 c0cc586e5f23e26cbdf0612d694514ab1999ac30b38ac4da0ecffb987c177e63
MD5 775653c39958e033c3e16af40ebc12e6
SHA1 babcbbc5fb917a066aca955d2d7ce07d7823e90b
SHA512 ec7db922bf3c5c39e7e8a8af78548966e248ab4a98de3981f96fe1acedc5fc79fa445341955a0e76ebee67ca272430c3026c831d7412f73afff5422886da9e0e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0kb:A3mnXoZjzyaT4aewsAjxTcgG6mRDb
TLSH
T1D425B023EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 972KB
SHA256 463edbff1b8b58c5856304803866baab6e9cbaf6e7194a7bf8c972b0c9793d5f
MD5 07a167dacc0ff2c012af251f1d24936a
SHA1 4b212fb283c2da681be9e36fb3c5909145950e83
SHA512 ad6424ce059ffb4b936b9a62091d8b121a302dc72cc396c1c36ca1cf12a76709d22825d3cba2b0a67f1a117b8bb0ad489ec10a58a1f17916fd1228991a4bbe4a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0qf:A3mnXoZjzyaT4aewsAjxTcgG6mRXf
TLSH
T1C725BF23EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 972KB
SHA256 c48b95fffca67de456ee8a09e72aa95eefb73c7342d0eb6527b3ca60af38ac40
MD5 4ff761cfe223dd9cc6c20b0f6fd482cf
SHA1 a217cb6f610231923a33ddc66a7621c78a7f5790
SHA512 b55d7437390a737880fe5d84f5a216ad00613c6f436b305ceb4d2e9089d968601435476ef9f04a27c42652390fba09c361c8d68dbf0e09cb756ebb508e9dc6df
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR03K:A3mnXoZjzyaT4aewsAjxTcgG6mRgK
TLSH
T14D25BF23EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 972KB
SHA256 1e97563456c2eedd8c75d522354ef5c97cf11e6137d11ef5f9afd513fb893cae
MD5 ec7498347b145786417ac002e8022b7a
SHA1 749b69711060cc1df97c3d9dcb5c24d5a680ce6c
SHA512 96a328a9d197a95fe003700ed4b4f0fb74915f89d1210e3754492b7c9b45bcd4eb59cb497ba936847fe49195cf63ceb222c343005dd819b0afe8b74c55c3a94c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0Ak:A3mnXoZjzyaT4aewsAjxTcgG6mRdk
TLSH
T17E25B023EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 972KB
SHA256 e9b0aa5c73b40d0c3ea6edb7f302d65495a126393db1d66a3114556ab020fd53
MD5 5c54563313ee7e305615351a114e0411
SHA1 5728577656b57659b29347826d7013e272a89841
SHA512 1cfc1722b667f832c5fe1961a69242b81499e5cbc8c8ea85513fed03d6f33d775fb75d47d290b36f0a5e3250f6d4ac739dcf4dd8ffc8bcc9daef9c6c3612fa96
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0x0:A3mnXoZjzyaT4aewsAjxTcgG6mRC0
TLSH
T18725BF23EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 972KB
SHA256 cdc6d55fcd3325b56a24dddd4611698898386e2954596db206a158701ff317d1
MD5 5935ec4885ac42d4443a50371b3dc4a5
SHA1 6485c1ea490be3a669af4d3f61fa9eafead166f4
SHA512 a634e05aa2de292c0348fa73f0cfc2625fb85a55220d3f0b53e84908addfb1d1d64bbd8e8809feb7bf4ddfc2f1dfd3bf4cbd7dcf675edad8628e482783ab9fdf
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0k70:A3mnXoZjzyaT4aewsAjxTcgG6mRRg
TLSH
T17025BF23EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 972KB
SHA256 6e5c43b094032233636b191946bf334c117a876c0835f96b231a3bc532cf87b6
MD5 81357bb1589acbab8c4d5a0f75807c39
SHA1 2b6fdb08344cab750f695a51b70271ab4914ef3f
SHA512 d4a35f69d56d826ded12fdc8797287506dc3670eca0147f07a99f71ad85b81e6cf9ab6d75e2ad2ceba2643b06ec4ff9e1495fae925d7ddde10bd68f76a5b7b23
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0Br:A3mnXoZjzyaT4aewsAjxTcgG6mR4r
TLSH
T13625B023EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 972KB
SHA256 7f23d8718d08eac78f465218c98a7a74896ae04d77110d6d3c76df786eca869f
MD5 b123bc90094b58cf6e8139212a72bd85
SHA1 daa49de8215b64a015e19783e0d184acb5e02a9d
SHA512 846bcd32b2fdc6cd7912da90e7b9132b635a5834f49942b6cee2c9d290b1c5501b08990700bb3ab384596df65b66443fb6f4daea31fa875b68d27d0cc5b2af9a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0Dn:A3mnXoZjzyaT4aewsAjxTcgG6mRWn
TLSH
T16D25BF23EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 972KB
SHA256 5707b361e189340c44a789b7eec2049476d54add44f568df4821a5fc1c1043c0
MD5 2d0721c487f41ae741b569c3d83404c4
SHA1 fe84757e133a4dd1132f9dce8e249e7f7215f42e
SHA512 b5cfaf0eb4d6995a6fddf2a2a9ac1de2eb3d8fc4e9e93c42cfbeef4ccb8c3dfefeb267c36c11a7653b260a0dc49bb3c65b3ba8d1dbb053037241133ecc352845
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0fx:A3mnXoZjzyaT4aewsAjxTcgG6mR8x
TLSH
T12425B023EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 972KB
SHA256 b7cd622d2b1e25aa0ba8cddb643db32d55a837b79037caa289c3058f1962982f
MD5 37ee234be91a1302bf2bd54ead1038dd
SHA1 a8f4dd23de4aa86f573ee1abe7c09d0e3e6f1f60
SHA512 1c1758b445424809da095f962885caff60e68c4bcded0871119eb051c4e9a3e06228883bc73f4e1fb7a9e6fc8fc6ffa8028fc85d4d899142a8b3180df975eee6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0FA:A3mnXoZjzyaT4aewsAjxTcgG6mR2A
TLSH
T16025B023EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 972KB
SHA256 b7ff9b7d31c35e982cdfc34844b963e0e09c46745f109c5f5aa03d789c343a14
MD5 c99a9b1360257bb586137258a767e2a6
SHA1 a50668cd8761c5a4efef2a403603fab5999c9e64
SHA512 ae06c09810253cc145f15b94ec539d04ff804ea66146fbd2df9e06eedb009f1d3eba4718b34c8cab612cd51778f2461934c45d9ac34d372a7b0b14932284ce25
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0+9Q:A3mnXoZjzyaT4aewsAjxTcgG6mRv9Q
TLSH
T1EA25BF23EBB090B5D22B49705BA58712EB787D610B6056CBF36C86592F317C03F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 972KB
SHA256 d703a85570dacb8bcb767af35362cf473355a840957fea44aa30797241418073
MD5 37e46c6afe28d112ea402592e684c131
SHA1 ecdb1a2557ec9d01ccaf7cdc5236d41e56541d51
SHA512 6e35f5217909cf0f6717376d681e29698760b855ca56d7a5ca9344c4e8944b8e6c49a1e10fdaaf48a684d0fe12f7c033bf65bbb769c40b4f55c375b5141557e7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0r4:A3mnXoZjzyaT4aewsAjxTcgG6mRG4
TLSH
T19825BF23EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 972KB
SHA256 0b58ee98d7d323cb6d498eb74c7f6afd316c9f6d0d829799a56d2c746f923833
MD5 abbd3f3d0aca7719c719bfab5a43dae9
SHA1 f79aeaae8908e74c9cc86c03dc6203e659188348
SHA512 5cb33db65449a51aadea5753cd96ed9c7db2d476e5d2c66e9d11fcf24ea23c0c990b042da87fbae5c8340e44b2aba3d90398e4e015d18bb3b5979b44bee06ea5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0iu:A3mnXoZjzyaT4aewsAjxTcgG6mRVu
TLSH
T12A25BF23EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 972KB
SHA256 783a5cfa25bf4cc02fe1d8167d608309805af43bb9ecc28a5c1ae66841721bb3
MD5 808016c393ae9194752dd605de8fe1cf
SHA1 34ecdfd2b9c618a63ee3c3460bbdf483a8abb2c8
SHA512 d41855f9c4aa51dc0d7b1e9c1c26bf8e39ee10363b6f9cc2ae5ba0df4379d0012eecf278a90f698bcabcbd95d7221d884a3e61a6be623469d18edf09f08cb4c3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0zj:A3mnXoZjzyaT4aewsAjxTcgG6mRIj
TLSH
T1F125B023EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 972KB
SHA256 6a2f9598bd8760eb28534d5291199ab510f8a8552b517dd7fffe1dc48d6dd448
MD5 98c5e7b5313fd042d68ef17c1d123ce1
SHA1 ac1cb01782dc9a81d00af505510eace531d7b952
SHA512 e93c86e6eaa529dbbe738401a0bcf989b819aafd0b1191c798da3966fe785e18df13a762632de1de920af6c52a4962ece80af0744f4c4bca895ece09600d41a6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0+g:A3mnXoZjzyaT4aewsAjxTcgG6mR5g
TLSH
T17625B023EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 972KB
SHA256 c1ef26f5db863f46524b87cd108dcc59ba8354ea548ba873d9acbefd6fa32c76
MD5 2d28f6c3b8cc3e9a1e54ec7b96108b37
SHA1 7ea355fadb65a337e99adead7c52697fe5ff97b8
SHA512 3c1dcea03c537d57e41a4ae3be4d4e9b5c6cdaaac634e99666822cc0cee7f9037a4b816be75ebf0d2fa40ecc97ded89ddd437f1043762e21e58628c3fc066bbf
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0xI:A3mnXoZjzyaT4aewsAjxTcgG6mRgI
TLSH
T13825BF23EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 972KB
SHA256 d1741249c54052b9d4051371ba0e3d1cc827083519570b75fa86af3f35b3fda7
MD5 6137c5c6150327452d20073c8ccf2761
SHA1 3bbadef3f159fc58562bd56b078425cf9dfa2578
SHA512 b7c967f660090eca47499beff70a97ec5d1694d561318b82f11e7aff9b928959dc05b380f4bec81218e697119121bd83b9ecce243e267dba709a760d0fb4a33b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0zo:A3mnXoZjzyaT4aewsAjxTcgG6mRio
TLSH
T14E25BF23EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 972KB
SHA256 f8f10461cff43c3aeefa10111534cd146a9d43b02f51612a986e2a30f80af02d
MD5 ef4ad92b07a394456fbfba6ca7a9ef1d
SHA1 f85985cc78ff5a23f8208735fa2217e21db27bef
SHA512 71896c384b5febce367c3dc5bd21078e3be7473e296cee00e5ed7e6365006dd0f761b05a7c16142464c5ad622c760a4e0a4a38355c768f4eb8eb1ff9144a004a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR04+:A3mnXoZjzyaT4aewsAjxTcgG6mRZ+
TLSH
T1D525B023EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 972KB
SHA256 b5a58fd6d43dfc96fbc728b7018787fac715bdfae4f76237d7bde7abcf6c8d4e
MD5 a2fdecca49e76d26feadb36d8f929ec4
SHA1 8ace3caa96025434f14a89f217709c318de5f18a
SHA512 2422e271821972a0061f27c49c9e2e830ac6b30303e2c10f69422afea78bfb2222cedad04a89e041b5920b3ae98e9c91c66205b6a51eb58f0156d903a2eeba80
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0QQ:A3mnXoZjzyaT4aewsAjxTcgG6mRHQ
TLSH
T13725BF23EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 972KB
SHA256 93b7bf76881d6b70decf4e19b70ee8e59294bdbbe53e6dbe5c9b14495a069c3a
MD5 44569e56250c4523854a53ea69a3497d
SHA1 7e6c6d0c73f1718a2d894c25ba069574094a68a8
SHA512 fd5fdc8ef87e8d5aaad80db4ee4a545e4bfc2316cd8e798dc3ef3bd163ceeb7b1d5dc9a1be1d8708541c2a41eef875c365bf4c3960dd561525cf836414a6e760
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR05X:A3mnXoZjzyaT4aewsAjxTcgG6mRcX
TLSH
T10325BF23EBB090B5D22B49705BA58712EB787D210B6056CBF36C86192F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 972KB
SHA256 99b4410e961a2da03f829860661cfdd9bc5bc3be0646618dc6fa68919fee2b67
MD5 f4375af9812d829cd348eb060d3dbc6b
SHA1 3f29b7dcab6527bd9e92099fbf2372de27b0f353
SHA512 ce3261f8f6b8a6d0158262815e920e2e4e21ff876e56b390d0ac167f0fd03641443ed58b8ada80d9f93a6ede2744fa71be6244667a81f4b052a41ddac7f94cef
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0TL:A3mnXoZjzyaT4aewsAjxTcgG6mRaL
TLSH
T14025B023EBB090B5D22B49705BA58712EB787D610B6056CBF36C86192F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 972KB
SHA256 3174b23f4f15af74d51b8239f04df2b6d248e71b8ea1d5f4bc63b8986f705163
MD5 73ba966ce3aadc56e44409953b0902d0
SHA1 d2f2566b5c7b342dcfb62036a8442d68cdb9de75
SHA512 6525b5aa5d1fa08f3ef2da8fefc206624619eb9b0ba58cd20015bfe5a7425fbfa5a2decb1c5ca1e510b7733dd9a211dd4e2348f56fffcb94af6553f44e34da2b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR05FC:A3mnXoZjzyaT4aewsAjxTcgG6mR+M
TLSH
T17D25BF23EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 972KB
SHA256 4811d34826124fc1d423248a864b1f39dc01e3030af01adc3d50a4e2a7874974
MD5 0f7f5bd6882f9367676147ce4b6ef3c9
SHA1 577658e46df56c3b745db1fc5eb49e89e36e40fd
SHA512 29d0050d35c42c066eafb4a40ba86f187170ee2e484480712a4460319c6329d8f8801197ace343da101b6ecfa3faf518bcc3890cda23fdb66a7ab382b6dedf1b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgG6mR0Ch:A3mnXoZjzyaT4aewsAjxTcgG6mRnh
TLSH
T18325B023EBB090B5D22B49705BA58712EB787D210B6056CBF36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4648-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5684-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5684-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads