67d114c95de40489a3e4c1c36b27305a050883397de23c2af009dddc9d79f8b0

Analysis

max time kernel
112s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Size 801KB
Sample260729-n6vsratblf
SHA256 67d114c95de40489a3e4c1c36b27305a050883397de23c2af009dddc9d79f8b0
MD5 f5e2984ddec1c270344f7fa68777a1a2
SHA1 e207ce3b8a95170c088bc0b358d97af6eb43d42b
SHA512 c5b94f327899f2fe6cea9ebd69c7f2dfa7006b86312b20be9debad5f942a7d28569ebda258f696137b957b8a0f2b7a2adf60aa327e2cecca82d6712a83617ee7
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L88:A3mnXoZjzyUTWaLl3z0zD5zy8
TLSH
T116059E57B39120F8D467813989665A22F7B2BC260730DADF13A457662F337E05E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/3340-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c561-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3340-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4364-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb6-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-480.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-504.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-597.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-629.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-708.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-739.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-770.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-795.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-844.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-857.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-876.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-936.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-955.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-986.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1054.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1097.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1140.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1153.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1187.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1346.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1405.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 43 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c561-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb6-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-225.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-262.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-389.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-480.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-504.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-597.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-629.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-708.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-739.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-770.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-795.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-844.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-857.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-876.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-895.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-897.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-917.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-936.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-955.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-986.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1041.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1054.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1097.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1140.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1153.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1179.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1187.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1224.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1327.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1346.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1371.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1385.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1403.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1404.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1405.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4364	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3340	2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
4364	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_f5e2984ddec1c270344f7fa68777a1a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3340

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 801KB
SHA256 67d114c95de40489a3e4c1c36b27305a050883397de23c2af009dddc9d79f8b0
MD5 f5e2984ddec1c270344f7fa68777a1a2
SHA1 e207ce3b8a95170c088bc0b358d97af6eb43d42b
SHA512 c5b94f327899f2fe6cea9ebd69c7f2dfa7006b86312b20be9debad5f942a7d28569ebda258f696137b957b8a0f2b7a2adf60aa327e2cecca82d6712a83617ee7
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L88:A3mnXoZjzyUTWaLl3z0zD5zy8
TLSH
T116059E57B39120F8D467813989665A22F7B2BC260730DADF13A457662F337E05E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 9574d7ad52e8889321a152cf00dcbb3060249924e635af9a1d431fb2f072201b
MD5 f777a2d25545f50ae5ed4dd60e4b5d37
SHA1 cdcb7ac3362449e20bf43676e16644bfa1ae61c9
SHA512 8b59675b5cceae3f9e55d09355b35d87ceabae097c9df8e5c193535eb64090c6ef3127c32c8ef6442e680aae7c363d97cb37da4728a9b2e4b01d412dcfd3b3b1
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zD5zyE0Le5ji0hmxNrM:A3kMhT1Llj8PPji0Aj
TLSH
T14B556B16F6A442B5D073C179C9D29A5AEB7238520B30CACF039497792F277E19E3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 816KB
SHA256 abe54f78165dca3b9a4305c6df2530a09623ad7f47957a2d9e5d30c42c505b3d
MD5 b5565a0a35f4858f4fb44bc622f1cfd4
SHA1 3e17f8ecad98e7cdf09a6348a020d062354e1704
SHA512 cc5bde42f744755c52813dc9a0c18e09075efa4e9abf2b39ccab859a49b429be213e2923530dee8983cb6ec3b513d2b8ab06e4675d08fba0f65872a443a07273
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8ua:A3mnXoZjzyUTWaLl3z0zD5zyua
TLSH
T1E2059E17B39120F8D467813989665A12F7B2BC260730DADF13A467662F337E05E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 849KB
SHA256 a75e92e2b0769d07522b67c69e6e056dba3cfd3d60c3697d94b7208ace037d46
MD5 78b28b650f536e4b99c23d15761c3e9e
SHA1 12af518f48abd874f8d1ae45fd1e168102830db0
SHA512 00abc4f8efbf044233815ccca0bf56877a757121c87f168508b9303737d86f4ceb4767f6a67de8f61874335f109f616adb079020edee0fb63619a48932edac67
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8tb:A3mnXoZjzyUTWaLl3z0zD5zytb
TLSH
T1D9059E17B39020F8D4678239C9A55A12F7B2BC660730CADF13A466662F337D05E3EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 825KB
SHA256 dff05dd6298671250c55725cda880fcdbf9e66c47356e45f7c19942365ab84c9
MD5 5b62298b3a706cd065430ab5023f958b
SHA1 65f83cea0b5b295dfbc308d35a6e37ef6d1090fa
SHA512 5260c2f82127c14c06977ae5ea7a818007e23d43c21d312a46d71bc29f80a667fe53b8ebbf9be52f4aed08d3de2fbb92f16cdde6d063b94b61dbbb0d93adcb7b
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8P6:A3mnXoZjzyUTWaLl3z0zD5zyP6
TLSH
T193059E17B39120F8D467813989A65A12F7B2BC260770DADF13A457662F337D06E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 825KB
SHA256 bd41e83690eca092ee38106cb431dc1980661e71237c4d16ef7650a6dd4fedeb
MD5 9531370a2d37c9fdadfa13418f3f4bc2
SHA1 c8c1e290b332af70e51e9f9646b0ba3837d9a4b1
SHA512 c2dad5eb69e51b2047844fc4c7df46c354367eee0f247bb31997a97225bf1303d4bcda546bc70efaef5b38c5b0ffce98b756ab5a7b2e2fac6f9b5196b03ab19c
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8RN:A3mnXoZjzyUTWaLl3z0zD5zyRN
TLSH
T1C6059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 825KB
SHA256 8770f0e31ac825f1744444f3f938199ff548fe113035c4140b1968ca928be936
MD5 f90dc1254914c3bacca6fe5d0e2d1d27
SHA1 b09faf2f584e81e2ebe26441f1c42fb415b47e78
SHA512 a2dd2a6f2e5cfc285f67098293881e6c4436dd13857f3cc1e2116d6d1ac7ed7987d19df4a6e2fe0e83cd36adbd2e9e62fbeaa69ccfda2c53228cf496bd5f55c3
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8Hf:A3mnXoZjzyUTWaLl3z0zD5zyHf
TLSH
T174059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 963KB
SHA256 c9b39d9e9a2388c7fdf743533fc528676c21508973aab8f4bd59c1dc07dbdef1
MD5 b0b9563773d581acd233754518d61e91
SHA1 b40e0e85336cb505f9c40acae598c8aee5dc9699
SHA512 68c811e392c2582f8059e92b2d7311226f4295b25a48dc00b68f47a8da81b66f36cb313f7ce180fde392f4bc8083e4dcd46f6d1987838d6e599f7cb761f878d4
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8jyPz5L87:A3mnXoZjzyUTWaLl3z0zD5zyOzy7
TLSH
T11C258D57B39120F8D466813989A65A12F772BC360730DAEF13A456762F337D06E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 825KB
SHA256 35b80b8ae83410ab94d88be20cb93e50e16a2ad489a9491e2ecc1f5a3e4fef74
MD5 d81836104c1a2813f8f8b70f17d105fe
SHA1 01dde6ade2561b3a82d4ce7f5cf5cea3ba87a177
SHA512 9dffc44be0e4552d8311af39053221b12b7fe3b098049d4da1996e1efeb51b935b4e4a1a7f127d5fc2c5d357a051636e23db3d7c5bf2d3d758768ff117e676ad
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8Jo:A3mnXoZjzyUTWaLl3z0zD5zyJo
TLSH
T10B059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 825KB
SHA256 f3b01e9469d239af72e48bfd197ec4ef4f248540c182279e4f6f0a5fef42a90d
MD5 bb6d7c94e3cca7476e063680899eb5d5
SHA1 4db031820d88a9ee7dc8e63f99bdafb621288514
SHA512 e8f50c5aefc293a2e9c0d60b5f4c8bc3913295650d3de5cc85d746abdcadd59fbdf001be48e6355260c30f202b63f94d2611f02b93d5bcf43abb106ef15c885f
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L85u:A3mnXoZjzyUTWaLl3z0zD5zy5u
TLSH
T147059E17B39120F8D467813989A65A12F7B2BC260770DADF13A457662F337D06E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 963KB
SHA256 cc1f8a575a7c49843876a8a2cc0f1b07c591b68f09e10685df800a229ffd617e
MD5 d2c2f60df4eff47b46baaba68137c2a7
SHA1 010e2d895ac72e3cddea57a19d84246c91bbd8bb
SHA512 54e115c02641d61835b4c1d601efac3d6e4050011df66c3a8dcafb0e687a9d7730dba453e23a875abf206b738dccb7a546e1f4edb669dfe234d22ef6a392b3e0
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8WyPz5L88:A3mnXoZjzyUTWaLl3z0zD5zyrzy8
TLSH
T1BF258D57B39120F8D466813989A65A12F772BC360730DAEF13A456762F337D06E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 825KB
SHA256 a37db21e9d4a30abaeb73c2de07f693471360727f81ca8ed4ea687c30bdf85aa
MD5 829cb56a0b2a2a38288c9cd56b51d3b1
SHA1 e99483d6e1725ad9ac2fb97c0abad76697340422
SHA512 8da29dff9a72b214be17229327856fe11a0db3e28c1eed1f29991e2a74b16aad6f8e767e0eee538f6619395e756f3cc6da57bf894a2b8c948ad2b3039aee5e46
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8f9:A3mnXoZjzyUTWaLl3z0zD5zyf9
TLSH
T164059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 825KB
SHA256 27a0ee2539b8f1c38d17d967cdcf81070fc12146911d168fcaadba8d741bc166
MD5 28d2240ad92b504a29c7d516fbbb03bd
SHA1 399c7a86c76609d9d55436af11fe7765a315a6e6
SHA512 59d7adc421377c94a4343811f8c87e3f623433280dccf9b295481a860c1d153adabf41093db1bbcd63617fb3f5d7e192d528011476aa8cc48fd5caef86f0e118
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L87c:A3mnXoZjzyUTWaLl3z0zD5zy7c
TLSH
T1C9059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 825KB
SHA256 1d1bbcd00e35eaab8b99dfd997dde15fdfc7df8a083b6309fc4eea7c7ec4d93f
MD5 b7751a523707332ea2bea4bf8415577c
SHA1 e84c0d8aa6a9f6c03128df2fed423255ffa5bff5
SHA512 71c9d571070fbc56afa1c2fb1d117368cf78e51a37cabdbe3136dca4561068085929c8bde82af7060dd3ed051d330c1047cfb2827ff21ee350fbf28fe9158f9f
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8kp:A3mnXoZjzyUTWaLl3z0zD5zykp
TLSH
T159059E17B39120F8D467813989A65A12F7B2BC260770DADF13A457662F337D06E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 825KB
SHA256 337eb649ffff7f553733044d761204d1662026ee98332579dce3f2f017120849
MD5 8fe192bc67c43f69c66566b225351e29
SHA1 91aaa60642fb3557c58def8c59df9320be2bb1ff
SHA512 c03d00c7724d0b6f606d01e3788d45e944746773600abc19f257a8992aa4b6f2e0d6f4d98dfc2a8e00f28479ca07a5e3a36989864f9ae771ceb8e29cdc77cb98
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8r0a:A3mnXoZjzyUTWaLl3z0zD5zyrN
TLSH
T128059E17B39120F8D467813989A65A12F7B2BC260770DADF13A457662F337D06E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 825KB
SHA256 8a17fd0c8abb0db1675ebda20cf94acfe9f740cc28b18c20ecb21c37685cca9b
MD5 eb4c09edbcabc061ccd9d1ea201514a9
SHA1 6c400a38ab586f5bd0b9eeec76e2ba3870234215
SHA512 c32c3d0a9476dcc25a05caa771a9bc976415a55dd92cba5f97ae31514aad9ca4234956b4fe7ffc0cdba6cd173f75713ebb99e1dcfa43af154495deca96f346ee
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L85F:A3mnXoZjzyUTWaLl3z0zD5zy5F
TLSH
T112059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 825KB
SHA256 f41b0b21372a345cb19ac139e18df8e98e1c488883291a0cb1ded577a1e50c20
MD5 e4dfb205d711d4cbf65b35e5cae1f732
SHA1 fc64cbf849292cc0272cfbf06d21601401ff3cc8
SHA512 f18d1edb37baad59e658d3b5b7f35bc3202278f320ff2b125c5ca9dd253c88b1ab278981b775769bd509bef46be15e59d096ee88aa843d0e2e0762c503abc468
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8SC:A3mnXoZjzyUTWaLl3z0zD5zySC
TLSH
T17B059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 825KB
SHA256 ef649d3af7df444892ca69bfb82b257df745bef17467a534f24a409c8b4a7474
MD5 0f551c13147d28edff4fac98c2260787
SHA1 9a65575f0bc1585b533c22608efa639687c9852b
SHA512 e01f62a15dacb971466e852c1b470507142da73aab42a869aae3b62c5059ea92697d879dcc10f6d57ee430dc67ce95f1f498fde8e7dbc313812b825986603b58
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8Nw:A3mnXoZjzyUTWaLl3z0zD5zyNw
TLSH
T165059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 825KB
SHA256 d77f342fcbbfc756ba94ee6601c601452ff6101420d45846204a15b920979679
MD5 d794e437d34877fd97cfbdd3d8724d5f
SHA1 dbb6b6d645222259c05bdb0dce96396b646366d5
SHA512 e6747f5c9cfc936ff3f6e8a9269caa6488919f0bbc63f5ac31552efacba684082625dc7edd01be88a4e78e5716e442a7946a6583345459e8c26eb4f14fe8e1fe
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L88T:A3mnXoZjzyUTWaLl3z0zD5zy8T
TLSH
T1E9059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 825KB
SHA256 8efae11cae4e0fa3bac1ecfd3d0d3179422dc3eeaf3e8f0a5faa3e16a68abf04
MD5 f3c9dda4ec20aea0c7f51ca4e9aa4186
SHA1 8f0ecd268bc0044f37dd5326cce1c98e94aaf510
SHA512 56de0b28dd3aab037245bf7e32906865b6fa22d69814425ba39608f9733d33b5982d061efd3d341fef026a684f59cb788e748dc0bc5d90376127d075d87e5883
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8Qu:A3mnXoZjzyUTWaLl3z0zD5zyQu
TLSH
T117059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 825KB
SHA256 e09b8b94b4989a3b341b4d297af9293744235f6b237ebf6f64a707218a3e5ebf
MD5 746aae3e78368df450e94c884efa5c05
SHA1 f1dd326af2e5adbdb91b5e4acdd68e0dfc13d347
SHA512 f46728e8b5d7fea23378b73006b9d74bb35591270089b971c7b948125e2530bd02f63461fea781001e2d88cfb90eea6af4e37768b5ba77c430e9e18c694858c4
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8ub:A3mnXoZjzyUTWaLl3z0zD5zyub
TLSH
T148059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 825KB
SHA256 cff5eae3d1caf14ed5b464bbb824d4dc3064f78114ad3e525a95c7c678ddbecd
MD5 d181fc9223b435b0f2474de647a1be55
SHA1 9109fcb07f07a456b9b4f52949fb31659aa4ec13
SHA512 2c48bf779faab16a6c976f6b27780ad35991e6e3f20aad7d9f068e0c00fcdfafc8dcfdc46a6abe8225ee02751368ff99a36c4bfcecb457088017be957a694dc6
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8Yf:A3mnXoZjzyUTWaLl3z0zD5zyYf
TLSH
T1E9059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 825KB
SHA256 21294ff01387409d211489f2b9e515ba09cd8a9852814e81473e16a2f71b1f8c
MD5 3cd7ebf6da0787ff1f25cf9f3c3f1528
SHA1 b7d244270ccbb2aa5bd02b0b5e9815299a250bfe
SHA512 538a3560abae4a0704ea7922ae418e916cfbd9f960c56165a9bece81a04c3859fd1e882419b2a8f36623711fa685ad43e1cce076551a267260c3ef54523a51d2
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8VK:A3mnXoZjzyUTWaLl3z0zD5zyVK
TLSH
T1C2059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 825KB
SHA256 1a2b3659c5ea4e77b5ac0fa7692dd6202e1130e0db06cc0aa0016a607f940e3e
MD5 0ff41d686b33e8cae18086222e3db116
SHA1 8d34fc0dd919373d973b1701690256467293b1e0
SHA512 cd09f8e49b8c82f8fb41d841cb777be356114f9c407d4c741e079f19c752c4a58b8276f1ed465afd5ad29d046bc4d1e1d4a128a8cab338eefb0e2ffc585553b4
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8Wk:A3mnXoZjzyUTWaLl3z0zD5zyWk
TLSH
T117059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 825KB
SHA256 e00bcd61678471db8edc63bb0a03c3e26cfc8c82cc8b63d940d4fd095df56271
MD5 04bd2b3cd2ace14291d5cbedd027da36
SHA1 43ab67616dd781e3c36f3312610cd24d2c4cbc99
SHA512 57922f9eed3e89b303db9416f0fcef579635927d153619838e04fbad6c3b8933bfa461c76e555331f17351237985d20445193fea363b4943577cf4926dcfb5ba
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8z0:A3mnXoZjzyUTWaLl3z0zD5zyz0
TLSH
T16F059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 825KB
SHA256 b452d812b27325dca54baf33e1779add8807e3e4e081d6a556d7c1a07c5585f2
MD5 29aec713a2dddec23311e06cb0805b7c
SHA1 d236b2c9f9c31fae9a2dac81a3234bfe11ee86a5
SHA512 3f0abf0af5ada2913d59b151283a415bff8ef9e2eec4a402b3089abf030f64f96e93a04004a0e6bbbb9742a55c3a088450ff0583a5d0c8e865cd96a4251f5a7c
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8C70:A3mnXoZjzyUTWaLl3z0zD5zyCg
TLSH
T172059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 825KB
SHA256 e594aed4a0ebc52a093c7fc49cf9d43aabe44e89ca25cde55a0f541a41ee3afc
MD5 0a7cb2f09384471af76144f36710880a
SHA1 54b189f10871f0d8d2bfdfd1b8aa6cf5e13e7087
SHA512 d58a812e4327b6e0e1cf7646dafc5a536f6210d15e6c8194c01ba7824f29ca09e47c5b5ece45eb13d88563b1b42da90c457358a77b6f601d2163cb6d4f25f6a5
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8jr:A3mnXoZjzyUTWaLl3z0zD5zyjr
TLSH
T123059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 825KB
SHA256 81c0eeb4adb9b34b4c169ab46374aba1724d63733639ad7e27a65c206177e478
MD5 62ce95c00388fcedb1b1df3647f92143
SHA1 4c4f235303bba74b1dc1f027e9f3b123e5c0ff87
SHA512 b2009ae916cb725b05c89286f41e16ea1cf67c04f067b236572c81791a66868e1aeb64eee347fa61c5695c9fd0e699ef159aa6d617b35ae93271e7fc3bc10760
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8Fn:A3mnXoZjzyUTWaLl3z0zD5zyFn
TLSH
T1BA059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 825KB
SHA256 4d3bbd0802c73a6f5a4a55ade5e30a68ccb388a2c6e0ba08941443e2ffa856a4
MD5 181516cf540ba69d5f21f00a782b9c2e
SHA1 db477e2d96abf79acb6d955536007dfd3345ad7b
SHA512 a33e81ca7cc4e4405ec7d0a79003d2a5f93ccd106250631da30e1cf1f6232e63f616fc9f6914564e473094acd04f1a901171dfcb15fb37b9d721038551500b1a
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8xx:A3mnXoZjzyUTWaLl3z0zD5zyxx
TLSH
T1CC059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 825KB
SHA256 bbda52805501964841eb9a8dc5bb7adc391de15329dd8c0542b1a894236a14a4
MD5 2e83dbff5e7f80dd873b271c8ccb940c
SHA1 d9dfc1b27db0332b1e897a568b3dda720d91fcc5
SHA512 7aa1c4d5d5268431baece2716ac0ca955dc5f084bff198632ea2c54f764e9b6ace1f8ac55bf31f06a830a914cfb2e7b5841899b56164772c05d52053d038f4f8
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8fA:A3mnXoZjzyUTWaLl3z0zD5zyfA
TLSH
T1BB059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 825KB
SHA256 a5d53e45181d4b3bc9e12211bcdfbb28f0f29f1d3416046a548dfc090e44d833
MD5 4a64a0de65d90e4f7d9742205ee52e35
SHA1 d52fb28b37c7e2be4fde59f321ccba09aa99a27b
SHA512 e696e378d4831d0000e620583da1a39d32e6d8229e241f27d3efe2089b5d99ee316d4da453022d70b8430d64f70d37ffbc69d458cd7be543735be3559385994e
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8w9Q:A3mnXoZjzyUTWaLl3z0zD5zyw9Q
TLSH
T17F059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 825KB
SHA256 e264f2952ddafedf13733110ff189c8d9c7df6aff107c4faad1bb9088b99a4c6
MD5 65bb8c4e45477f7c33de3abec5ca88ff
SHA1 bc540d1cd73936a49ee50e9a1d7e72f435ee701d
SHA512 6147709ad4a9de3f541cd51924aa5371306e5e424e2972d7f1975a909b88ace5243096cb7c2297a962fd8c997d711bcfdd4a5528e3af4abf5176cb847cebd756
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8R4:A3mnXoZjzyUTWaLl3z0zD5zyR4
TLSH
T1C4059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 825KB
SHA256 f5594e455cc768c7c85e211c51b5b2b3250d32267f22b7b07245acd36e66a5d1
MD5 44e7f91c5006473efa32f01a2070207c
SHA1 f5d0c4e5a85778a537e1617e185438138aea0525
SHA512 74336e915d2175356003b6ea0c7fcaac97023be6d3aa944fdc0a4eaef67c7ed3c8e5905b2310f85f53b58c1a28453b667c705464e9b36218811f38d3e83d3911
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8Uu:A3mnXoZjzyUTWaLl3z0zD5zyUu
TLSH
T109059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 825KB
SHA256 99f3095fdbd46d99e5d7e10d747528cc39035e4e3913d05809e9ae134dc386cf
MD5 6b5aca5f4f0932aecd4e681606b1685f
SHA1 0ce52734520d8b734acf89fdc7089d34af9b5741
SHA512 f27cd8d1e5f84f616e936c18bcc60048bda61dff8a3c1391b7d9c026c44769971cdbd610805284e751be329d7a3b770cc515391ebcb89f9669b48ef3f71879de
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8lj:A3mnXoZjzyUTWaLl3z0zD5zylj
TLSH
T1AF059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 825KB
SHA256 218c0d1bfd2d68ce1da0272f39bd0cbcdaa7ed161eb48b1ca6aecf08f482dfdd
MD5 8ce822e5da458c293feff0f676b721de
SHA1 d6bd716b7229a58016ffeafdd579a5eacc230a4e
SHA512 f7cdae5564733d074eced948b1524e15985007651b0d65a9c4f78c093af0a6e0ddfc9517b436c86ce75c5f26582d65fac140f6fe422ba82e0705fc37f57f459d
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8sg:A3mnXoZjzyUTWaLl3z0zD5zysg
TLSH
T1E3059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 825KB
SHA256 a9ba9f1a4fd7524f47bb412f454a16d47bddb5c6a9592e2d4d5545a1110d94a5
MD5 bb8469462f6297d164474d6f9c18fe69
SHA1 07c22ca7c1e9c0f13b28441cf7fdaf78856cea68
SHA512 fbf0803feb1f577c469587189f3318c3c935e868456546fc3cc547fdec9dcee13515c21b53d19ac60dc8dd7e4c28a3cefde4068c56941b67a668e689f3f18940
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8zI:A3mnXoZjzyUTWaLl3z0zD5zyzI
TLSH
T105059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 825KB
SHA256 6d335b43b2b81a57f527ebdfe96f26d5a48303e25bb1828239851a39373fca99
MD5 2059cf92c1bd670f56dd8b6a868de0e8
SHA1 42716efd91236e40c2eec0431d86afd0dd3d3f4c
SHA512 4923b1209bb067685f090ef9cc6518ee43e2f22528cc78124c18aa97b25315bb848733bc9244f6405afcbbc1781143d7c9927ef4c790ac2c1eef8f0852d1e0b6
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8Jo:A3mnXoZjzyUTWaLl3z0zD5zyJo
TLSH
T1C2059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 825KB
SHA256 db06c06b33c52e33422639df0d09c0db0080c76cfec425f10addc7c6e78924b6
MD5 54266b20cb206ed7c0a72eee71e748f3
SHA1 7294d137b4d6177a64bca7d6ce4869e043e21402
SHA512 1899389006e788f52fcd9a76d73c0ec6721a245aecf7fcb923ba069e86748f06cfe66e1980dbf1deb7457475ae3bbcd0187e61de4ba1d73cca2e66d38d8b34e3
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L86+:A3mnXoZjzyUTWaLl3z0zD5zy6+
TLSH
T1C3059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 825KB
SHA256 f86db204f129e26604af851022f422ca54d15d97f668c3fc3e485aceef93dce9
MD5 02c45bece5435ea5df3757741d0e432f
SHA1 4ebb3f18e5833e88365eb5b3c4d1abff32dd7a5d
SHA512 5f68ab7f355eae96ac97fcd4ecba3f323bdb9d7af07c4619c8fbbfc6fdbf926976dd80bf348541faed66f04daec7ac7b5a452cfece81fdff38f72f5a5ab29e50
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L86Q:A3mnXoZjzyUTWaLl3z0zD5zy6Q
TLSH
T11C059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 825KB
SHA256 017bc16eb839a0a4786696a154016cc4a69f0e88ee98df860a6e8fd76f73a856
MD5 da9310eb7bb343958473ae9e9b7ee21b
SHA1 74f601d62c0f1cd2c3db76777a578dfa38a2863e
SHA512 f80f4ffb58241293c6556f9c47511f204ead4bfa0544b607b61f799751da3a8f1ad7d303024efb19f239cb384a051222e0a41f32916f87fbab627078c2db3a2b
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8LX:A3mnXoZjzyUTWaLl3z0zD5zyLX
TLSH
T1EB059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 825KB
SHA256 fb03776301c65ca4dc26a31a9595a47df5e63cca31668c674cc701290aa652ab
MD5 0811768b47b2917a60c39d958a78953b
SHA1 5a71934841a4f77b71f19d7018f74740446eb353
SHA512 f0f84fb38b3a45d79c13837ca0c8816b1a1ea8628f03c8185d94d7e4b7f54accc08f8ccf49df765cdf9a471c3257f4bdba09d3fd45ca4d2642499fba573cc6ad
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8ZL:A3mnXoZjzyUTWaLl3z0zD5zyZL
TLSH
T1B6059E17B39120F8D467813989A65A12F7B2BC260770CADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 825KB
SHA256 1d67c761b691c6773575b560f8a5ffbd77c8c8e857fbfb9187bddf65bc6af44f
MD5 a3b03a476cba5874ecee283ba94a56c4
SHA1 3f5890247f2b42ffa0c87aebf29a37b131d7709b
SHA512 49db22cbdfe99075abaf090b16e400db76f9070dc8b2c891646604a5195b8faa068043e6768b2728d330a55d20b1d6082205ed06eb5cdcfaae22ff350d8a655e
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8HFC:A3mnXoZjzyUTWaLl3z0zD5zyHM
TLSH
T1C1059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 825KB
SHA256 7dc31a688edf16d7e30f9a245efe09095eaef61ebcda810d0f8c01dfbacb65e3
MD5 1f883fa96316908fd7f27b8051fc2d03
SHA1 7d290b2624ccb92aebefc48b0fc8ed6d9a843cfa
SHA512 3441b8d1418947ad0131a6f3041edbaaa4ce1e3f9ad808a0faf6ed08a85b4082ce7a495b3d9529b5dc394c007ac74e0420b3ecc1f8986246d73e179b47eea662
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhYyPz5L8wh:A3mnXoZjzyUTWaLl3z0zD5zywh
TLSH
T128059E17B39120F8D467813989A65A12F7B2BC260730DADF13A457662F337D06E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3340-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3340-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4364-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads