6fa6d06b56c10515013cd29727378830b1490ddf33741bca6412cd0faca0d52f

Analysis

max time kernel
105s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_98fa380882fe539cc9064ba5eb6351fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 939KB
Sample260729-2cm3psw1ev
SHA256 6fa6d06b56c10515013cd29727378830b1490ddf33741bca6412cd0faca0d52f
MD5 98fa380882fe539cc9064ba5eb6351fd
SHA1 e850148c269721864d5de0639a3131fde1ac69b6
SHA512 a6e0e48b92d032152f59e104e589815ff497b2e361fa84facd2598e18bb9483c530b93e5c5e02063d8b450339449af8ca73cb852cd525eed84af042c59d11bd7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbo:A3k03kHRJS
TLSH
T1D025AF13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3500-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c519-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3500-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4120-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-498.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-590.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-700.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-737.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-926.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-982.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1123.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c519-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-224.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-498.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-590.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-621.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-700.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-737.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-786.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-907.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-926.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-982.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1043.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1080.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1123.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1182.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1219.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1328.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1341.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1372.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1379.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4120	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-29_98fa380882fe539cc9064ba5eb6351fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-29_98fa380882fe539cc9064ba5eb6351fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-07-29_98fa380882fe539cc9064ba5eb6351fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zFM.exe	2026-07-29_98fa380882fe539cc9064ba5eb6351fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-29_98fa380882fe539cc9064ba5eb6351fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-29_98fa380882fe539cc9064ba5eb6351fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-29_98fa380882fe539cc9064ba5eb6351fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-07-29_98fa380882fe539cc9064ba5eb6351fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_98fa380882fe539cc9064ba5eb6351fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-29_98fa380882fe539cc9064ba5eb6351fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3500	2026-07-29_98fa380882fe539cc9064ba5eb6351fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4120	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-29_98fa380882fe539cc9064ba5eb6351fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_98fa380882fe539cc9064ba5eb6351fd_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3500

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 939KB
SHA256 6fa6d06b56c10515013cd29727378830b1490ddf33741bca6412cd0faca0d52f
MD5 98fa380882fe539cc9064ba5eb6351fd
SHA1 e850148c269721864d5de0639a3131fde1ac69b6
SHA512 a6e0e48b92d032152f59e104e589815ff497b2e361fa84facd2598e18bb9483c530b93e5c5e02063d8b450339449af8ca73cb852cd525eed84af042c59d11bd7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbo:A3k03kHRJS
TLSH
T1D025AF13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 da7c5511914b0e7df88b1bb9ea455ba2e3731f23d96eade47f68801c59532c5f
MD5 a34ce1f9920bd17793a01c2bae0495f8
SHA1 9b32d163a10a50a1ea79fd87c9ed09ad950bacee
SHA512 80d4f38b8c9c58391ec06fddd479db00e28473fc052737b3cbf4bfe5aea1c346bfd49fd4e0fc03df84e0d54116fc9a7159cd223beb28bf2d1483cff79887ec74
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbw0Le5ji0hmxNrM:A3k03kHRJSPji0Aj
TLSH
T183658C17F6A402B5D027C1B9C5D69A6AEE7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 954KB
SHA256 41c98145888cdf640be9defa77121d2f83ac793cc0b3daa2742968571877994c
MD5 2edc708bfaf20a62b129974f91690daf
SHA1 4908076358c3c8833b1b5e16f5f89497870a8758
SHA512 903a0bb3e6bc97d6ba46aafab81abbccd7484db0e3dce2a39fe333f37a25a452cfffa743c728df12526323bb0c4c504264a8dcd2dea328b310c9f04f1def1034
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbKa:A3k03kHRJ
TLSH
T1BE25AF13EB9504E5E10AC174AAE64A23EB757C56176093DF2358C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 963KB
SHA256 7f067446814d0a88eab150090ac196b1ab5a507846f5316d81d2d68d97b0e3bf
MD5 0e5c162a15bd8522cc23515dd3b29a92
SHA1 76e416d4331ae7959005a614ef8bc8bb629bbd9a
SHA512 149d6c5d9b4577d4d6380096a2877ba56a6b84ec49718df35b1cf0dc64a495a912c5943d478dc587beed392ea17fbed8758cebc7e4d3edb40afcecc4230c2333
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccb76:A3k03kHRJ8
TLSH
T18425AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 963KB
SHA256 2645aba0c22e9efae624979038714c3b57cfd17f7783d34075f53cefe60a0d12
MD5 825a2609b5a538c6b8375b99e35f1225
SHA1 b687d8e1f67a8cf2b67896509a31e0570c6eb74f
SHA512 038727f165ec31379ae69648c55c71ef45e9d615fbd9080b8eb98ad06f10c46e477260c7cd76e761ad3e2e31f0862443ac1fc03490b163f20fd6eb9b909e5af1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccblN:A3k03kHRJh
TLSH
T1FC25AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 963KB
SHA256 b70cd3d220a20335562fbb70a0a5b2d577edf2b133a65f3b93948886aff521c4
MD5 1a669bcee9547d715683000c1636ea26
SHA1 f524886e6541199713c070f4e2413f33dd65e87f
SHA512 1b9d5be131dd82ee5b224fe0f1883229b581104338975a9baf1f56679cf8a176436ef065c088801eae07db5402cf05ede621c4756d35c953454c08cf378ec281
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbjf:A3k03kHRJB
TLSH
T19B25AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 963KB
SHA256 9857e9479432fcb2caf8ef27037aaad3a45ce7ef224698fb14aa1c632d4f0e98
MD5 cd439f2b6346496b5534b6288473820c
SHA1 c77c08ab6d26f377e8dd32c4700e3b9ab67c6388
SHA512 cbc6f5db007dec68da634d222beeecc96a71960032ea762d18cc2ade89d4465d3f9dc4f1654b6c1a2444b323df934a2042911c4ed6e78991e8092a8eb0a0bac2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccb1o:A3k03kHRJU
TLSH
T14A25AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 963KB
SHA256 88a977990f28a226994319d0dbe49cdf88123d67d242f0706a03225d89a4fb8b
MD5 721f427fbf61e0675db7a3b6d7992f07
SHA1 bc792b2834a6471370a667b351fe866b40186fdb
SHA512 f362f490a000809df09345d6dca4e8fb493e2d18fa0c7d6783c867a5b66b34acf3ff80191cf83c59464cf56f49702eaa321783e47f057bcab0f3c47f562da954
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccb1u:A3k03kHRJm
TLSH
T1CD25AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 963KB
SHA256 1ad1777fc2ccd40815b947cf2872c2089e7b7afa9dfe4c7710aaf6e34f8227db
MD5 d5f172b00057fff4841bc90395743f84
SHA1 8cb961ac8c36e0774978c14540524cc5a51a1f86
SHA512 8ec28ae0ed0579f8d697268105ed13cbad04dab367a8db35aa4fd31dd1cd307d0c57e30caf288cb016ff91786876f65017219be2e072f8204fff4bfc5d4f7468
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbr9:A3k03kHRJn
TLSH
T1CE25AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 963KB
SHA256 a2ac43af6385806a34bc3208a67056371fd049d73ea8b3d97eff24bade68bc98
MD5 115065a471b596be9c5cf68b186b8b65
SHA1 2e9ccd8dcf9f1afc3ab604049696a3489aae8874
SHA512 a1dc3b759fbad494100b5252d30f3472d783dbf09c5949b3fbc6bb97a91263760a2829ac123cabc682b6f8e65d2010530f60bbc2010362b1fc5c097055e780ed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccb3c:A3k03kHRJ2
TLSH
T14425AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 963KB
SHA256 6a93c08d0a89237fca379ab4e2aa30ad9ab0f9316dcd5877e7832d6d7a95d57e
MD5 381859bf358091fa8ffa71f49fdd4ea3
SHA1 2288f63c06e211be7129f4176b4408f4b4f007ab
SHA512 a80474f85fa547bf66a5ceeea9a119a21185802b3ae8079028d6a2ad565b3e285974676dd5431d37603cdf04de01f625050c6ed07115dea68ad0dc53e6abee72
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbAp:A3k03kHRJk
TLSH
T14325AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 963KB
SHA256 b9ca44ccd1ea3e8ba0ef11da722fb06bde62fa9918e54419af3385af5edf93fe
MD5 bd617e7604bf30898c3684df371a09fa
SHA1 5352bda93c9a56fdd66149f21adba4d429132e59
SHA512 9f4cfef76c51c42dd90ee9609e5f79f68d8531fe78763ffd3d6ccc11578efae8036247678370a192258791f69b17b21f987baaed531cf13eaae2191664f252fb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbHN:A3k03kHRJT
TLSH
T19525AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 963KB
SHA256 7231b0f33019b55c06a1501db3dc8ddef3f6f6b538481d5c1d7e4bdd9f9c99ae
MD5 f15d1a56c8fd69a267523c44028b54af
SHA1 f07b8d9ba0e8f4a6555443bf3bfae18d752b43f1
SHA512 44ec2fa47efc6550993d63c194796440580cb1ccdd19ba31792d4b4b1a4d57d6994a0a8fe8d05302304fa45b3b70b95ad29b3ac7519c2e93797c463829644dff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccblF:A3k03kHRJl
TLSH
T1A325AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 963KB
SHA256 9efaee9cdeaca6b56ad616075b45f8a8ed437e55cb58853274a75a9d50ccfd51
MD5 d0f27bc15d213f8fb77bba00688bb011
SHA1 ce1c45b95f36e9063a1c0ef9bc97a40f355e99b9
SHA512 4971fefb0ba8a7706f9af2f52f1d768a9eb89552a4f0645e65ff13167e6969e9dbced2093d85ecb3e621ffbf9f5e33a8baa27f1793b003fe96b7ddfdeec78907
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbGC:A3k03kHRJJ
TLSH
T1BB25AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 963KB
SHA256 eeab82e3bdd58b4bfc21a530e11b44eddbab770ce8ef6532e3b5c8058ba8d38c
MD5 c6102a29395549b1019a9bb09903ae9a
SHA1 ba6b6e8cd46dabe33ef63ee6ed500ed895b067f9
SHA512 7de65fe70d5d451d61035dbb6a07fe0060e0ec13cc3ad2feefacbfa85d1dfce3a6517c78292934c43bc213613768a30e331c15315b500b58621594b07b9fc58e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbJw:A3k03kHRJ0
TLSH
T1FF25AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 963KB
SHA256 cf1ad2b69327ce170dfa31c944908cfe207528539f40645fbc7f720d3ebc88d4
MD5 b32f0db414a9499738190fcb230426ec
SHA1 2d931bba86bdd8e73cc1acc0b3e37dd67186a65e
SHA512 7ff61fa6ea87b3b85825df9e9c1d7666b323209957d68ae2965e96f0df33825881acfc83b3803ed7ff783a60d67e752cfbfa4db21501373692f0c9e3eaced20e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbQT:A3k03kHRJc
TLSH
T13F25AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 963KB
SHA256 08489840388591e5cbc9d1e0a891de3c310615139051bf6443ba5ce0075674ce
MD5 e9eb3db2a77e401e64eaf4f59d2fe2a8
SHA1 723a63c4879c093bfdff7f9c1a4cbab454b95583
SHA512 55bb67bf119ed729c4486164724ee47531e2e81b3d73166ed44166132f4df6ce61c2e88cd0c2b35d0111d99bc35adc5f23ef7b8186107e4b39dff3f1d49a8703
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccb8u:A3k03kHRJ7
TLSH
T1B525AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 963KB
SHA256 bb4b208849c200f7eac6ffb72dbfabacdf0e031433985ec4560671946666879e
MD5 1da7962aad28c14f5dc53b6318da5933
SHA1 e9f98e68d02e35e243ccf2151dc7ea41c6286de6
SHA512 569ae90bc449880e5cc15423fbf25bc579cf4e015a0c9539852532b142c6676c89d0e9da5abce7ecf9a4033ddd55eedfd4cc4b7144042db075a7d40b1b0f9839
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbab:A3k03kHRJS
TLSH
T1C725AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 963KB
SHA256 68fc7acc9a6fbba6cbde414b063f4737f3765a0202f7f3832fd05f735e2e9178
MD5 e6272e437d03841d9a42bf4cabe90565
SHA1 7fed8cc9bf38c7d6653af9c49ac96137e7206ef5
SHA512 bbc4e262ccb854498d06a02d7c195e9389b4b110cf43630d912dcadbca81700bdafc1bd8c54bfdc80bbec8103094bc533029fb3d2ac7108cfc565439a9a15301
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbcf:A3k03kHRJy
TLSH
T1CF25AF13EB9504E9E10AC174AAD54A23EB75BD56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 963KB
SHA256 dec3727335c2ae4b7b398db15b98167c52df142ffff42ef64521b745d54c2568
MD5 4d957d65a6908bcb9159c1e4265cc826
SHA1 d69782f0c001897b065d6271772bf97dfdca9c4a
SHA512 f13ebd5e1320cc55cec46db890579727d44f95ced6f26fb768adc1bcd2d07d61fabb0822f2cc732339709188c3c618268b0d8004cb3f109c3f4d87ffb10985e8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccb5K:A3k03kHRJS
TLSH
T1FD25AF13EB9504E9E10AC174AAD54A23EB75BD56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 963KB
SHA256 dcb99eff4618d467dd3f81d92e769c6612ddc5151aa0c30d1afc5e24c4faad1a
MD5 36872adf77f7e48389ae5226b5258d79
SHA1 25b910996572d3fed7e61523e710f10764e83f5a
SHA512 5423aae193cb47f7c7bacdee338013c4f2796a595524463d0bec4234d153b1fd20593f556d70525727435c8759ca21e67c7fe94d19e7751ee6a822b155d32cd7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbik:A3k03kHRJn
TLSH
T16625AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 963KB
SHA256 4eeed7610fe1edf70f8ee620c33940cc6c4fca293d9bad6f38f1d3a44288ffe2
MD5 dca8b97ea3b759a6089267eed08c22e7
SHA1 ecd200ea2a0b29cc64f171cfc413c87646fa2ed1
SHA512 f632260962403bf44b30a77bf208020cb8134f7ac2cd82a2750eff66ed2d8e288a42c2853c7d8ccdcd265cb8d4352695351ec6dddcb8ac0b33d26a04eab339b6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccb30:A3k03kHRJm
TLSH
T12C25AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 963KB
SHA256 3e5ba5f15b131ce7df4d4cb83dd396b072dd77ff06ba9e80c2ddd142e4d07148
MD5 d8403dd56525be3665b63776553636f6
SHA1 997f36c94be5415425971a60cb0e3382f536f231
SHA512 c01a51c358e80ea4da8e52e9c29a9d181f636f613e665f607bc7452c2a4f340956afae32b5730cf122ffa20bd2c5bc7b85efd38c15528b29e07a14eb6bde446b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbmg:A3k03kHRJf
TLSH
T11725AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 963KB
SHA256 9f3aa1011f26b270d91d68718ff87a10d1a43091ab43039309df612380cc416a
MD5 ba9670538a1e339ec35647eeb44c6ee9
SHA1 bdf756b118248ee48eecba7e2cfa531e994b80f7
SHA512 bf44e72105f4034c3115c2483135b5674f3dc1365727676cfebf870ac5ae68f7a70f07ac56622586e179192cdf5adcc8c4fedcac38fa6b52dafd2ad351aacdfe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbvr:A3k03kHRJ5
TLSH
T19325AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 963KB
SHA256 bb2ac8739379a11fba313c2c09968814a6d55d12ee358acc774674efad374adb
MD5 3af97725192f88cdc95265d3dd28b91e
SHA1 4100a60cf5155ff13e3345c4f4dbaf7ebf7c37d7
SHA512 364facc0e292a83cbd81e3e63af6b2e96a1da4745cc7bfba630fa0dc50356986cc5f8755e5f6f6a505fa3923b66d48016e79d00b6a7e0e42529d7dda7e8e7676
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccb5n:A3k03kHRJz
TLSH
T16F25AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 963KB
SHA256 db11a0a33628873bbae93fb8e52a02dc2e34b39dd27eee4fbececc55cee645d3
MD5 56b4d8d5a12c52f296f9fb31b9773ab9
SHA1 d90302fa0a5ec8b8eccfe605f06bdeba11fdcb71
SHA512 f6335f9e1278212b24b0bd83dc97231cc456612efa4413483529a3934676ff6c6247a9a96bc148f14d71da6ce97dc3af80e9c36f4e19b8fefc492a2b54771228
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbVx:A3k03kHRJx
TLSH
T1B325AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 963KB
SHA256 c56dc4f591cc7b38dbb8cc336ac8f895b1a02c1d3e70a18a82c37db733ac6717
MD5 e8baa825e386d0fdbde8d8a64442073f
SHA1 26813b85d31bcd77140068669f7352e32d8ad6c7
SHA512 984cbb5162d9801e5883db9e86d90d927bf6f1376c4aedc0611e9f56d169656b7aa05cf7773bda245ebf88a772497e7e8ddc18af1af9779edd879aa1c79a64b6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbLA:A3k03kHRJe
TLSH
T19325AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 963KB
SHA256 c6b17e367d2b4b88fb996bc3ab03df2dcf5748f58ce0d8c05963df4755551a32
MD5 651336b44714e30be2f3c6e6903768e8
SHA1 a037ac660a7d26ec0a4bfb90b9f38b54e55bcdb9
SHA512 e44f05e2dc3b3ad2839a063ee9d626bb500775a9ff352a4238445b764cd2d1f2bfbd0307fa85fd3ec9cfb94290de0116565e87ad04a995dfe623b0ed7faf072d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbc9Q:A3k03kHRJD
TLSH
T13C25AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 963KB
SHA256 5f3513478c7d8d03556aa24bb61865513885ed2d1aa4b9c4cf3f493826d7a64e
MD5 d1e6a104545eae91ef6ee22f72f374ad
SHA1 e1c4ac56469d46ad6b2acdfb86937b26bd79af7e
SHA512 7e27a59cd0514153aceb22167a99e631ccb8ce58c095c998d932c30aef1296b35c8a9fc4d19f847ca23cbeb158fb63ffba19517d921c5367d2bc51ad8cfae224
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbF4:A3k03kHRJk
TLSH
T1C025AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 963KB
SHA256 9b76a8288a15207a405d441029436e791e9b8e0a6a147c01d99e59774f38e437
MD5 6d2f493396cbb4c14ec1f50b4caaa428
SHA1 bd7d9640ac3ddca39cc40a4c0d4baa41b489f061
SHA512 93ecd98ecd30699bec3d6f4701535619e36ba06c975ced97530b493471301022fdad8600d74df4b31b93f7f2caad4cc2ac95557bd9bb13d83c5a8173444b7805
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbQu:A3k03kHRJV
TLSH
T10225AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 963KB
SHA256 16dad004c38830fb5c5402bb4c8e1f1811c7123f48e7a4a5864bd34d5779b6c5
MD5 22cd4f60fc5aa2c12a1862ada8ac7e08
SHA1 2e956cb8152ab58be44370470106343d391ed98e
SHA512 56027b7c34a4ec371224253c9f07745cf461d8e561efac348e15cf1bca0d828b9980c1af2149059d5a81b178a2f195c75e808fbf6c2f7c21ae042b038ad4ed0d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbRj:A3k03kHRJ3
TLSH
T1CB25AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 963KB
SHA256 e15ee83b66a20a72947bf5ca07b06ccf8bb761aed19b3b2fdfb2f0165c9e83b6
MD5 795950a278cf4fc6ba9bd1af4c96eb8a
SHA1 e427c11fe525e04fec0eb4c6c1b08316f195618e
SHA512 71631fc79c394d20d1b61273893d78f63f398d889f60f812409b02f2170eda713e5cb5eff692924c6f7e06d255f8664e1deb4b9ffe5d46aab8017c1c22783d0b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccb4g:A3k03kHRJf
TLSH
T1F625AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 963KB
SHA256 8630c88b5af54a535d2d7f9fc1f93a6c2bfce87c6369434f9a439388117d638f
MD5 49aba889196e2a865c2b3c032f707ffc
SHA1 b442c01069249cc73e614ab0ca48c5c6c42bcfd6
SHA512 33339ddad2a97af6856ffd3b5fd1946bdf31339e1c9f479feb4e0ddbf00a827d8363d0eadea7486555c74fa63b956b84d388f0fb711b524352408d59970468d3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbXI:A3k03kHRJO
TLSH
T12825AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 963KB
SHA256 4d1c10abefca32346fe6e3296ac210330758a2e612890690c245c43fb945a330
MD5 a5815370cde14c9b3cd4bea940d7d391
SHA1 1ee3be79836c63fa59bfcefe8a1c1a43b91d2e61
SHA512 b9b63abb1caba591c74f9918fb4f45f6b49b7f4be04e1d29c1b02d678bbf3e50bc6c05a9ccb86b1f70d065076caf61d900a01a0a349953487e07b41357567e6e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbdo:A3k03kHRJM
TLSH
T10B25AF13EB9504E9E10AC174AAD54A23EB75BD56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 963KB
SHA256 7c2dba4d681aaae4df61f1396d3d5b6a60378e30ceaeb4d088adb70504cd34c5
MD5 89fd9dbd89ff193d8282737d1ce79f9c
SHA1 14db62696ac656050f4d5ef962f028895ea9f6d9
SHA512 50f8dbc66ecdf4807c76231bbdcf0c0a1463ac2a3ce92c71ba9bc56e9e0519a7619bff976ed05b469a2acb1ad082cbe091d055aff531a64bfbcc2a19ccd11797
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbO+:A3k03kHRJh
TLSH
T1DC25AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 963KB
SHA256 0b41b7af0471f0237305dff1cf37f7b254eb32190064b22d8170c55eda071b83
MD5 ce84dfe67205efd21d7d717c3fdb5210
SHA1 c08de4699e6717aee6d0347c2178b10402a31909
SHA512 b82dc6646c1377d7663c8b3ea06fe8e683f432a102b2d30491d5fe8fd5bdec1b979f62d1fbe95d45a59f9b78f0211db73de7c6f363dc2a0a46dfb82b213526fe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbOQ:A3k03kHRJh
TLSH
T11225AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 963KB
SHA256 a613111313c475e337e21a137ffad58cc7abdf8285942e9b2a869cb1c346e69a
MD5 080cafc6a272c320dd4d6413bd6e8af5
SHA1 8ee2b83a1ccbb2811685244e679b450720dacc59
SHA512 3bf76ccbdaefb378da09e63523cc74671aa09004826bec411eb2593805c2d8c20e846a72d18ba2e02851b216414061ead33f5b3ff835c71086e0ebdb1f66e98f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbvX:A3k03kHRJN
TLSH
T18A25AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 963KB
SHA256 0156faf8916b92d184754148327cf9872c64640031e9f02a140179ea9f379408
MD5 613111c2843ad7d64d2bd51e38a3e641
SHA1 0788f99236099af2feefa2beefaab38e318b5ecb
SHA512 6aae2aee06abefdb9fb2af4ba3cf9b6f36abab082345085e7f1bee82556d3f336d86f6a442aaf83888eb032cd26e6ef3c6e4e015a7053237cec757907277a998
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccblL:A3k03kHRJP
TLSH
T11025AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 963KB
SHA256 53ac6b3ed292259195c04e0c4e018b1bc37211af69af3ebb729bea35b44806c1
MD5 f8dd6dc7efd26bdf1c1d4f84157806df
SHA1 65b3d697e88eb44f389ca773595bebaaf5efc4ad
SHA512 2193bdae47e4d9fa16eb88ea3454548f85cd82ad26005d0a054ca3f6c1545ed351c0606ed6b87fc6624a0248d316feeae2928912e087e3bead72fde28c492954
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbDM:A3k03kHRJ6
TLSH
T14B25AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 963KB
SHA256 8c3d6601423387229d1d11ccda2b7cc503f14f2c2136fabbfd9419f956efaa88
MD5 c27e338e939c6cf073498d668089a3c7
SHA1 53c8f2482077f47ff8c79b1aa0902b9c1712ca49
SHA512 e21408e3dfad73cdfe137d148212dc71799be3e99d662e603f482d5c597547c07f1766c58efcae20df52f1e83f85f29e4f4956e0ad25115e6682b787a31d7e53
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xRaccbEh:A3k03kHRJ0
TLSH
T17825AF13EB9504E9E10AC174AAD64A23EB757D56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3500-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3500-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4120-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads