cade2670e9b8efeb111c6c121dc31d505f8e4c5c87c32d59490e45b4fa6462d4

Analysis

max time kernel
104s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 933KB
Sample260729-xt41bs1ake
SHA256 cade2670e9b8efeb111c6c121dc31d505f8e4c5c87c32d59490e45b4fa6462d4
MD5 f20427d43bdbd05978883531ffe60780
SHA1 01fca790f65d57e83bf32a85b41ac4fff0fb20bc
SHA512 505bc3584c76a9290ce649ef9d5e37ced0660b5290f26f913fe076eac5f0892da715db1e0836f03de178bfe8044d66b6c7b57d40802aef628a69876a99978778
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5/:A3k03kB56rT/
TLSH
T1EB157B03E6850FA5D00F81749A958662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5048-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000b00000001c63b-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b0-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1300-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5048-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a42-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982f-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0016000000018a41-568.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-654.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-772.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-797.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-1091.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000b00000001c63b-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b0-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d1-57.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a42-234.dat	aspack_v212_v242
behavioral2/files/0x000400000001982f-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bf-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-489.dat	aspack_v212_v242
behavioral2/files/0x0016000000018a41-568.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-654.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-772.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-797.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-1091.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1134.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1364.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1371.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1300	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5048	2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
1300	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5048

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 933KB
SHA256 cade2670e9b8efeb111c6c121dc31d505f8e4c5c87c32d59490e45b4fa6462d4
MD5 f20427d43bdbd05978883531ffe60780
SHA1 01fca790f65d57e83bf32a85b41ac4fff0fb20bc
SHA512 505bc3584c76a9290ce649ef9d5e37ced0660b5290f26f913fe076eac5f0892da715db1e0836f03de178bfe8044d66b6c7b57d40802aef628a69876a99978778
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5/:A3k03kB56rT/
TLSH
T1EB157B03E6850FA5D00F81749A958662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 e37cf68e38844f5b6ea96fea1805fac67f7b66bf9da463f7b4668fa7ad8fe7b1
MD5 70c5ca9ff9dafb245152333b4bbc03b9
SHA1 ce82e30942f18b894c90a9f923304dcbc1f07d44
SHA512 fa035cdeba62cc0d5d5d6a56aa623200b03247b4689e758c424bd96b4c99396e076565b4fa0c4672089cc0f3749dc3c55580bd7e7c2feceae0e400e8ffc4417f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5r0Le5ji0hmxNrM:A3k03kB56rTrPji0Aj
TLSH
T10F655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 947KB
SHA256 b779e202e742c61b9659d5cea89b1a5167bc1b147b40ced830ebd8840832147b
MD5 7eb0a1fef4589b0bf49b82e375035f8c
SHA1 f838f4c81a77f7b77ef6859ab7ddd8259fc56d11
SHA512 5a8546ec7538b63508799133a3415f2aa67b65f30290f12ac8d04861c5279862b8270960e054b825d8ab4daad35613b2ee6c996b4d6a4687759ab6bfe4102e4d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5ta:A3k03kB56rT
TLSH
T106257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 957KB
SHA256 82bb1391b6523f64c6efaba6803508393e114119cfb65c24cc3919a3bf275a2f
MD5 169c7b81b3712c02dc8c029937e84cc7
SHA1 a0488566fd2759b22ff227ecce042f8d1204e339
SHA512 22cf7df7f6778c1a6a652c50c556d55d7efc4604f21d1c8760e41f322d887cff60aaba68fe8d4bee6bf88bd7dafdc89652ac89f6b22a0f939f17ab7156e89955
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5k6:A3k03kB56rTz
TLSH
T104257B03E6850FA5D00F81749A958662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 957KB
SHA256 c706be986cbf4af505ef6591ea1bd1db5bdfb512f3303a81b80aa24d059246f5
MD5 0ba822c309ca7c9d1150ef751db51d06
SHA1 87643266688e07bbde5f130998d063b19b35ee00
SHA512 0009d4b88fb96a9e139012b4e5208865370589aa07cdeaf4d769575447e69b50269a2e99afceb64e191b9134b2fcea836c7ea0e86a7f84df684fe7bb81a4cc92
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5AN:A3k03kB56rTu
TLSH
T1D7258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 957KB
SHA256 ca986eec3e46e0de916f7445ddd264082c1334f69ba57f65e7a6b4996980d539
MD5 27b68fc27f2b73517f33ee95f31f7e72
SHA1 a1e0891efa94a4a2611a180290b1d52237014b26
SHA512 ea381c6ce9159552c33ce95043a31a1af7682fd738ce1ababb01b51257d752a14390ba1b0d6c873d5f9ed2ec26cd7d7b8d4197a0e87c795730bb60d07cb19f0d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5uf:A3k03kB56rTi
TLSH
T15C257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 957KB
SHA256 27c5a7266c0531efac300764d5127a22bbbbd8d5c65baad70e826102e698e90a
MD5 d511f10198716241d02931840d04907a
SHA1 408d47395ac50cb644258b15fa4d8cf3484212a7
SHA512 096ad45f0f217582af68712b65d9b68feababf9eab4b3bf8dae009befab4a2af5aedc0cf6e0aa8123f6129dae9874bcbe022a9dc48fff83badd7375e92b6ffe8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5Yo:A3k03kB56rTr
TLSH
T1A0258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 957KB
SHA256 b62439aaf3e944d2954fb33043256747b906ef2fafd21d602021fc5321c10072
MD5 7116ab56ed5e26fd1663499dc263edba
SHA1 7aa481ca2f7770822a8fd8503ab9595e65ebeedd
SHA512 dda942c348962cf82a4d877a4ce928b3d2121409153f092974a9fde83707223605e7f401f8b59182cdcb45a5d6440a0edb7c42a43cfd70aadf3fe6a55cc6b7ed
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5ou:A3k03kB56rTN
TLSH
T1FA258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 957KB
SHA256 8e7298f855d4340dff633969984c69655b83bb04e163b745e15caaf8098f15ec
MD5 48e986ec23ff7b71d3512a4e74a3fba4
SHA1 8ffb870351a791212f107f3d65322afceff32d98
SHA512 60dd87f513361e2803612b7c458d53e2f88428cc5aeb0fc53c1fcb5a9658e0bb216fdef0746e3bc4a34a6ef30d1c65b7958423381962536ffa8c4fceccfcd761
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+589:A3k03kB56rT4
TLSH
T193257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 957KB
SHA256 a9c00ec24e3f03727496d72c593989651769830bffa2cf58488861244fc41ad6
MD5 c2c33cb4bf2abb6be0e5e444bf0d6fc0
SHA1 f0b3d740ddc98a81136a93c6ddf111d7f9df870f
SHA512 5b77751b354c0b8c418becd65a0609400065d3eba9cc7cbddd2ae3c9bb071adb749d35883277014b6332a0222e4ccff1a73eae3f77679f0285ad2d5426ba14ea
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5kc:A3k03kB56rT5
TLSH
T187257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 957KB
SHA256 71973806b063f9d72e141da2e4bd2b68cb7087eec019ef1ea4388c06e451c8be
MD5 7c3ef42e6a67840ff929b5f9793986b4
SHA1 f287a3279aeba289888f486f31c27b99b17b35ae
SHA512 bec5606a5560fed013de66307daeb93013555c15791ccdc3b4954a9e8eed2a8454a5ceb0c62e9f9255f2ceb8181fc30b962c041dd3ce4cfb7d25ff9f5ab7e3eb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+59p:A3k03kB56rT3
TLSH
T122258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 957KB
SHA256 3e29f9a80fa1bd7f91ba9a79e5b8ee60dfd0cb2c1d3cb85342e2651a1e409117
MD5 6cd01de17889879c9b31f21b2a87a2f1
SHA1 b412b7d6768bdbaf0c05ea54f746c0594ab23c4f
SHA512 8b85fe3e7548468a4a87ab51c1024c6a2a603fb35262d87712df927dc98a0fd17a63c4e11570906d4c83c1bc7064bda9b697c356fc8fcc3cf607b7f36d136e03
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5CN:A3k03kB56rTc
TLSH
T1C6258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 957KB
SHA256 be01c149cecd03ec6534e917396d70569000f99d55d2ab5d32da8cbe28f8539f
MD5 21c21d749edc86835aadd56f65fe6387
SHA1 cdbbb3fffaff79815e0d130d65feb42b4d8b9023
SHA512 113f684f42087c9af5eb14b764f8fdb80c31b1e4d11e4d0fc965cc11780f2b03670478d71778fb46f4d21a2d0f2f8c405e96be268b5860c9baa42e30fd7892e6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5mF:A3k03kB56rTq
TLSH
T1DB257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 957KB
SHA256 c7017d0e6f63b35851fb60c97d6b11933aff42248bab131da5342cf18379f9cb
MD5 9acfd960fddc5b484d6c0297e5ba6a89
SHA1 bf93cd18d439da07b692f3a51a82719260286834
SHA512 321dbf61ab9c24f56b1a6729751e41e3096c99b013d754bb9d525e2d3020cb068f14abbf7481fc7af45a43a4c7ae7498cffccfa78d9ed1e66c276c1baa653192
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5zC:A3k03kB56rT+
TLSH
T153257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 957KB
SHA256 6ba47e6f6390fa37887a197180f45bf61b8c657fa91415c328c6d2d79b562943
MD5 8758d148ae8d51183b34c8522731f074
SHA1 8213d7bc9ef73c313c649fd52573e368ee5eb4fa
SHA512 933ee807f263c5ea2465996602269596eb5f7b3f6383be8cdf1e9e2afe3e7b3b30bfa5a50aaf34dd1918e76a1d3813131b63c91db95f59ac1961708598c07a76
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+58w:A3k03kB56rTL
TLSH
T106257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 957KB
SHA256 897e711647a7364519740fb173bb4e0515f1a3225a2b168a072a1f558f293719
MD5 2dcaf33706d21bff13c507fec487927c
SHA1 9806895cbf1cac4f994fa2ca337e0eba0ec17798
SHA512 d2ebc15c81895f5d7b78b696ddd4bf17cdd4fcbe2abe4b724fc997f2e8ebe5edc5876613a339da330c33536bbe6e14aa040026aa24d18ead9cab0b37dd76c77e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5zT:A3k03kB56rT3
TLSH
T167257B03E6850FA5D00F81749A958662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 957KB
SHA256 51cafaf1b5b3fb35297912bdef4e86524f38ca6594b7d2143be7ae9cd6036807
MD5 74e2819f3795fe599c788d0f88beb12a
SHA1 0feda832bcb1678e0c37902fcf2b3a70cc48732f
SHA512 2f62064b30953b9f79684850d13f7b9fef46870343bdd43586f6e245c49462f1ef75fca8f4ddbf325f4877c99ae118c25dea225b414a23570b05a5288a4a65a2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5Fu:A3k03kB56rT4
TLSH
T1DB257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 957KB
SHA256 9d191b2e3833026fa84caabffa7c96592eb375cf47e98fa4726be08b0bb59045
MD5 973fed920df4b7b35c97ffe3719bb928
SHA1 bf03f47011709957e11dffd59b047cdc6a165c79
SHA512 a4f6dae946d3069ea33703c88341f8b06baddd0e46097cdd69449561b1e20fef7f492192e7abb0bb5343dfcb3c2c2938d9172fc201862c4d1b0795ee948ad997
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5Nb:A3k03kB56rTh
TLSH
T1A9257B03E6850FA9D00F81749A954662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 957KB
SHA256 92af3308f4cb1c285a84a5fce7ccb4e1d4cb6832ead6127287a29bae1534517b
MD5 57558c34adc5af600eea2f818b3ef162
SHA1 4538a0ceb8fce9eff095b805a7b4674059eaafce
SHA512 44d8502e2044bb4c70c5ddbb1d839be1cbbbb5be8cc819b13120688eb16bc2eda35c0b3bfc60d579929154c96c402f32f13c9f9ea8afd204d198f19cfd5999e8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+59f:A3k03kB56rTh
TLSH
T107257B03E6850FA5D00F81749A958662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 957KB
SHA256 b780cb27ab4605080a7243f33dad0da5c142d6267b0e35c3dc4516f4251b1ad2
MD5 05f1d234019816d98e05cca5be3a1aee
SHA1 49948583599d9403253eab75141739f1ed5b5894
SHA512 50c00e0ebc7400a7d50f43a16f898db43a3f15c8d7083ef723deb10a7416d20dc8aadde5f5de9f75f2e711e7fce4b830b2ffa91a88cf914198e4a8bac48d5f71
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5mK:A3k03kB56rT5
TLSH
T1B7257B03E6850FA5D00F81749A958662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 957KB
SHA256 b729e50dc8f4f02b32acd69ec3ffb2a86d36708bb1be43da1c6b3e79dbef4e30
MD5 f6d44f1fe04ae5c8d44b5d3bec631a04
SHA1 f5c76d72fc3bae79fb8d1e1cecfb94507d8bfc30
SHA512 d8ce64cb21c20a39d4c25ecd43ff860778ac6e214f4d341f11b90f310ae43c71d259cb14744f1787e37caded154a4f6296ec86e3f6c8c1729b46336cd6d71802
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5Tk:A3k03kB56rTw
TLSH
T12B257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 957KB
SHA256 366aa860af3d15d360d896e8293500ebdc402eb39c73566f89d3e4f508c5bacf
MD5 3ed87d3470505180112139da9c51e9f2
SHA1 ca87b64667bf3db68b1b68c75902b5481813f1db
SHA512 b2dc93f70f9e6f1aaa625ff9fb4ab3ca2ac5e54b265f3ab89c4fd013844c372b1f2a319758dc85b05a554b8bba7aa619621556e707b5f229a32ef9434fe4abb9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5k0:A3k03kB56rTZ
TLSH
T16B257B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 957KB
SHA256 b7f1a19d21ba4fa0aae949e9b13e7a828b8746e3947090118384d488c78f30d3
MD5 66a549895d2331cc4639a85594bfd3f2
SHA1 a14e88f3d80028180a8a78ea6d179bcf4ad5aef5
SHA512 1c7ee2ec802d43e8d34e89ce5f66484667fa44c6b1aaf56fa195ee92b6572423d64866b57ce3d8f09fd9c4fb1e2b1d8e7631918ddff5745c69558f1d2267a94f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5fg:A3k03kB56rTI
TLSH
T165257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 957KB
SHA256 4171290caf42090763da2e75963de8d9978d38b4cbe84003e8214d08b274311f
MD5 043dfd921f6438af2fd685ad4097a102
SHA1 6b499121c3092ecc0afe47dbf92e85ce928bc7ea
SHA512 bd6bb4b85592dee5fdd7609fce8e33ca19dd40709a1ea507e864a85cd318244dd8ca1a6aa19ca3fa447d1d42fc38764c232b164ae6e55b90fe08dea80a46b107
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5yr:A3k03kB56rTy
TLSH
T155258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 957KB
SHA256 ad96896417d43ba3b5a66f6a1affb8f1faa6f84855faf76d6d94bdaa20092173
MD5 080b3b6531c772a88389fb76eca9f37a
SHA1 b42b76b73e73baa28a54b87cbd7ce9f4ea2e1a4c
SHA512 07cd9b0c930ef84bbdfd4f24d680f5eb9318d5be4e0280059b59fe863769368ead8346972024afe09934875e797749c0f7305d740b00ed4c97e32542838e2e15
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5Qn:A3k03kB56rTk
TLSH
T1A3258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 957KB
SHA256 8d27c5c6864430eaa84a96863fe3ee7a68db6ed0bff396c87520d73d78b86f77
MD5 a86e894fb1cb3f9494a11143c5add03a
SHA1 32302a1a43e89994fb2e7ff50891a7e605cc40d0
SHA512 c7a673ef4300126c8588650d58aff134a6fd153a5e9e27eccd36b8cd09b73a92843287445ad4c2fab15889ec58bd92995f985678fd74ceee081ed7b4226360e0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5ux:A3k03kB56rTC
TLSH
T12B258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 957KB
SHA256 40af1791c01762396246a7ac6d7a322b7fa54673de7de987353358abfe7876c5
MD5 b57b6a97504b8c20f328de6155e9c032
SHA1 88a4d7f8325d96bca79b13e9e29757b3ce482822
SHA512 27bef6e6edd83f729e80f4a2bd18b87ce5563632390c6a0bbf400942467ca2739f6e58498db14e5115c5c8569f1ef2b3bb3559bbdb1aba71d89082715fe0e381
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5IA:A3k03kB56rTh
TLSH
T190257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 957KB
SHA256 a8b34ea10dd834d61f675da29e9f860187c17dc0f0c11da34feb6c4f8aaa080b
MD5 34eaebae30a784676734e52de6a90050
SHA1 63f3f04df25ce941d42ef2f68d9ffe262bda9283
SHA512 b7065b0deeed8f1fb7c9545078eae1eb8eee499075dd72db7ad29e191f5438fbe9960585c190ace4b0fca60807773eb7b035f8b50ec4472c92f76a075c43aa0f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5h9Q:A3k03kB56rTY
TLSH
T1A2257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 957KB
SHA256 84cdf5c5bc1eb1f46c494bbd566bbc49079fa6d965292b0e46900ac36cafb0c5
MD5 90927c3b56754c8e0ecdf97f490c22b2
SHA1 06f10b875dae36a9e68a0c29d26866bfc8489523
SHA512 88ad8a7a5361924de3ca0c35228eacafffbdd38124bfd035ada60b9ffbfe826a7963b848f5a2403508d983e2cc662004d11888c511a5bc2a3471b20a276f7d26
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5U4:A3k03kB56rTj
TLSH
T1DC257B03E6850FA5D00F81749A958662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 957KB
SHA256 9d3968ac1952705ff162f407813a902d71cfc521c0e424ebc4e6dc94e23d9c80
MD5 2714a39da46119791140842047d51b21
SHA1 b4b68a577d3a42f13e480ece713225f8d29183e5
SHA512 201a861a3092ce79b419bfc219ba6af0f6a756c751ae99a89e89d774a8cb525a898093b8b24b0f392fd0e8c2c99376006872ff8365dde9c25ef53a23d3ff1240
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5/u:A3k03kB56rTG
TLSH
T1EB257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 957KB
SHA256 911c1c607650a36b6637a0b51e7b2021c6b6d308733d6202bb417f0a0a9c23d6
MD5 c41bf8dc4f591027abd0773906cd52a1
SHA1 f42fe3025fc0ac0a74a57357d2daf1f24cd931b7
SHA512 39eec317214b2c27b4cfe71786c7fd9a244fab2532bdd1abe15d6046f40865b646846c4de40f7289242cc7f10161e5b8143a948669e3cbe25c5457fdad64aa96
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5aj:A3k03kB56rT4
TLSH
T155257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 957KB
SHA256 0ec9ad6acc2296a00e536a014571c39bc0a76150af88316921e10782543739dd
MD5 dfaeab8fec4fe14379c5fc1d2744aa90
SHA1 f75b9920d4d5378287f82754ef6176b7b7783b45
SHA512 f2318f01a5916cf6027a7299401a1356c72dfc2d51f958911d95affc20a514cb89658e45dfbbc07a5e512e35f01fb2e17caf5a0b795b122042f379485926154b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5Hg:A3k03kB56rTA
TLSH
T1B3258B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 957KB
SHA256 f4b5f1d22a6116e467cb874ab1cc360d1af3bc2820a06bf7a5a75c0c4db9d88e
MD5 b2138027076b365d2360c04438b76f92
SHA1 f16a827124ead3edfbbd300dc50db9bfeb74b6c9
SHA512 efddc9e1e998ff052b33e989715056505d2e90d4d86628058c4fedc3cefdfcc218a16083e92790b49344079b826e51fe07f31d9d856eefe7478f10535df34db9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5aI:A3k03kB56rTB
TLSH
T117257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 957KB
SHA256 6c6d2d6d9119a267ef74ea4ef0dabda7b20e05bf2e8e7a52ab9146c6a26f22f9
MD5 7a8ae0245290680555a97e61ec4961d3
SHA1 bb0dbeec22d707d0a1adccfc8883a9088c8166b0
SHA512 6cf3b141da92a53bea857332eb95050a6803ec24ff554d9736675821193d12bb8dcf25d10733a0d3a02d239dec7e703a1aec147e32fa180426367d883e5030f3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5Yo:A3k03kB56rTf
TLSH
T119257B03E6850FA9D00F81749A954662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 957KB
SHA256 005e07e78101ac31e49f7248681481fdee549bc3159ac57a8a0c48a1bf3ef2f4
MD5 9305f922195a6b86a680dc5c670a7dfe
SHA1 204ec317ef5e11d3a112c44c659b42e39f0beb62
SHA512 c23375ec21b983d8ee0a4add46c1857ac96ced0332b792c99bad81d40b48d1f9df887a23db8cb8ef74f4d31ef91cc00944daf61a8bc06ee011e2a040e4357af5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5r+:A3k03kB56rTq
TLSH
T108257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 957KB
SHA256 996a13392367dcdb19e1e65ac156647e515771e3208289f4519155063e881d4a
MD5 6817be65da616f04214cdf62d0219364
SHA1 48741d384c35e65c4633c8a128a32a27b8d41ef3
SHA512 fe506a12d04f596ddd6e5e123cad1b7cfc1b9d5e44ac1fbb11c670aa8d4af92316473de338328e88cd98f341d9f4517ba8d2431a1f6a9b87705513ed473aad32
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5hQ:A3k03kB56rTu
TLSH
T1E7257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 957KB
SHA256 d3862d3d672e1feba693c8034f5887c0cd16c5b7b15b8e47bbc15b8fbb3ba652
MD5 311a1876a78ce06c67aec9a57692e37a
SHA1 a97f786858df0696b263228687624d4ef3f115c5
SHA512 6ddf62c9981578af7a955e51460b7546816c7bda07a860817d8a3540525037495a45fff3f01738fff27f7b8b12fb9c139329b85ab0ab9b2ea99242fbb311d8f9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5mX:A3k03kB56rTu
TLSH
T186257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 957KB
SHA256 b454bc46abecb34baf91f59d27d950afb7faeb9b6e684b4a43478a77be6a4600
MD5 667046b0ad714dd0a7055c100478e520
SHA1 11daf62304e330e8efb271778167d7a35c0ca2e0
SHA512 f37a79b8f02f521e573c8320ee864947f6064882cbe39151cb16bca1e7bcb405f0af6ac1eac95c755a0aa16a645e57f5bd2375bf92ab45b21de2df5470e8004c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5gL:A3k03kB56rTA
TLSH
T1AC257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 957KB
SHA256 7d1f6ccc2cae95fe1ccd21f8470ed2e8b787fee970070b40f19b3d10b3dc2a90
MD5 da62c160582435a84fbafacb938853ff
SHA1 b351a24dc611e8261c7955d14ed01a0b7b0b8a99
SHA512 0732c2a3dd959dafc4487dd65f03bbf0e2e33c8bacb94db062c6cc72e67db4ea3f0e76cc1f87bdc5a997a2dd26e0429c4d0a642d48d1cabac99adf1ac96f49f7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5MM:A3k03kB56rTR
TLSH
T12D257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 957KB
SHA256 3fa93f0dfe05d0d0ecf6a8fb0e53a769dd2ba3c5d877e7a8154e8e0da08f21fc
MD5 bf54a6acf7b247c89dc7124e5519fa52
SHA1 92709e65cb3d2086a9109368816ac64e5d29a159
SHA512 04aac460b38946f67418332ed5c8087dec7fd96dbeb03d3480623e876c5696589187c72159568b26751b77653543737f402dff0369314ba4dab8b57e4131de1f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5Vh:A3k03kB56rTj
TLSH
T150257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1300-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5048-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5048-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads