bd7719c94f0a3506c8c573b54e069c24144d712d421bb9a655bfc98a8d679270

Analysis

max time kernel
110s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_511fff11af42d9aa1dcbe73b13f7cf0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 901KB
Sample260730-warefsdq6w
SHA256 bd7719c94f0a3506c8c573b54e069c24144d712d421bb9a655bfc98a8d679270
MD5 511fff11af42d9aa1dcbe73b13f7cf0a
SHA1 95b38b130c6064b1a78c9035a599bc1e1babb18f
SHA512 23014d0f6cd2e0d322858b6cd086f86dee8e692bc38161d62c716fe60f7157c93c06315c981aeb1df72620bfb536e3d5ee761a0fc0c5e34223eee58b774b588c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1o:A3k03kHRJz
TLSH
T14315AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/5672-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5e4-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-12.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5672-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3340-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb6-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-443.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-492.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-577.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-620.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-657.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-732.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-769.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-824.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-855.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-874.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-913.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-953.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1008.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1051.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1088.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1137.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1169.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1177.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1184.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1323.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1336.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1355.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1405.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5e4-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-12.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb6-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-225.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-262.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-443.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-492.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-577.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-620.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-657.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-732.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-769.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-824.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-855.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-874.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-887.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-894.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-913.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-933.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-953.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1008.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1051.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1088.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1137.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1169.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1177.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1184.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1323.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1336.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1355.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1374.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1389.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1403.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1405.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3340	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-30_511fff11af42d9aa1dcbe73b13f7cf0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-30_511fff11af42d9aa1dcbe73b13f7cf0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$	patcher.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	2026-07-30_511fff11af42d9aa1dcbe73b13f7cf0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	2026-07-30_511fff11af42d9aa1dcbe73b13f7cf0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-07-30_511fff11af42d9aa1dcbe73b13f7cf0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-07-30_511fff11af42d9aa1dcbe73b13f7cf0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	2026-07-30_511fff11af42d9aa1dcbe73b13f7cf0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_511fff11af42d9aa1dcbe73b13f7cf0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-30_511fff11af42d9aa1dcbe73b13f7cf0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5672	2026-07-30_511fff11af42d9aa1dcbe73b13f7cf0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3340	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_511fff11af42d9aa1dcbe73b13f7cf0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_511fff11af42d9aa1dcbe73b13f7cf0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5672

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 901KB
SHA256 bd7719c94f0a3506c8c573b54e069c24144d712d421bb9a655bfc98a8d679270
MD5 511fff11af42d9aa1dcbe73b13f7cf0a
SHA1 95b38b130c6064b1a78c9035a599bc1e1babb18f
SHA512 23014d0f6cd2e0d322858b6cd086f86dee8e692bc38161d62c716fe60f7157c93c06315c981aeb1df72620bfb536e3d5ee761a0fc0c5e34223eee58b774b588c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1o:A3k03kHRJz
TLSH
T14315AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 3cc6e2cc768f43c04a012f46bfbb3118a3f5a4fef7e2a588f0974bb04a0333bd
MD5 581a9d6e573cdc57f04a368fe1a8644a
SHA1 8126221269764c2205d095d8479a26785e7b8e61
SHA512 a5cbeb7fce3902cf110d0aa4f100604e50c4a5332486af6ac37bc6b12471d8d10a1e703d969af9c4743616d1d0376c1ca1957636f0046ffaa9b471e8f7017a71
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1w0Le5ji0hmxNrM:A3k03kHRJvPji0Aj
TLSH
T145658C17F6A402B5D027C1B9C5D6965AFA7138821B3086CF1399C7283F67BE19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 915KB
SHA256 5dc4c44ea075a1ba281b0a518741c6d0c4e10f452d03c4b3a8644dfc1a95f6f0
MD5 6b4b1bb961a3019c36cb3650cd073692
SHA1 0cf922eba84802cfabf23a79623a96b2104f3fc6
SHA512 2dd6fd3634baf20a4e5d97555780d886fc5d8cf73ae485d63e4e72323e553419cecf689da3cbc392d06df575d563ff90fbf132b3ab51d35f11fee3dce4b68bbb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1Ka:A3k03kHRJ
TLSH
T11715AE13EB9500E9D10AC1749AE64A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 948KB
SHA256 f62bb6f27cf89e8a522c97fad2eb4839ebe1ad64825ccc0fddc8e94af34f981d
MD5 9fba0c62aea0c6b2889bee53a615bd0f
SHA1 96085b4da68238a74900b92e79c70b50d1f08eec
SHA512 8827130ad6967fc8e6fdfb34403890f9ee31683c66bdedcd52b9baae15d325cb3794c08e7135274dbc4b3719dd03d145fc90d6cd94de3aa11e7ba0f9b04b9adc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1Zb:A3k03kHRJSb
TLSH
T10225AE13EB9400E9E10AC1749AE58623FB75BD56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 924KB
SHA256 13405f0da8833d0b747cb2949438f14dfb06dfb2bd680f7f2e6b87c44751e7ba
MD5 456bc7bc9159525f955c5623844d818b
SHA1 310aad91183a85ddfa4cb926a87bc76411840cc3
SHA512 ae8424e0806bc8a958ef1261d4b19fe0eaa699f86db6c9c380817b2e13965acf2ad93502f3667530059b2143f0f7a504dcc4acc9c82ca2586764e2348e0386c6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy176:A3k03kHRJ3
TLSH
T13015AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 924KB
SHA256 df0da14ad270af1484fcde23332b36bddd8aa7cf9574b14ef8e8db65c9788d25
MD5 cabcbf6ffec91eee102771c898af31d1
SHA1 ebf5c05e57988fab82607caf65ea42c7bf3dbc84
SHA512 a48eda7041fcb2d523b2ae924c8ffa7015d8f1104cc55653d057f479d43a174c25cc569783afc17b8845e775ad44357b4cffdb7856ba95b68ab5a43a950684bf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1lN:A3k03kHRJK
TLSH
T10F15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 924KB
SHA256 e9e027561133175d97c055b2e921540ecbd178b5a2a29d69eecb466faa819002
MD5 abc526f48800972822ba9a0cdbe5c272
SHA1 88a8a65f2849ac304cecf4a7d1fb53057ccead3d
SHA512 e6aa8427a733aea9b5013b2351ec7e1c2ca4db8c0b9074ebd7f2dc76832a432970ad004994a87955f41d319d8689efebfd41e344e1ab6eacb0f6c50535aeccc2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1jf:A3k03kHRJm
TLSH
T18F15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 924KB
SHA256 089c4f4532da5b246fce329598232c4bdf6c76fc71492bbbb49596c916b3b7b6
MD5 1a4dbff4ba361d7dd0de9f1cb5571987
SHA1 b9df33b3b7d5453197778fa49802a62376514857
SHA512 9a094e5a76fc44cfc08e9e33dcd1bf4a5cbe8fec74e663729be4387e352e9d07a98dc02f3cdea2ad6f07d559172168db496ab019eaf6f6bb73ce1bf9bc05f938
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy11o:A3k03kHRJH
TLSH
T1D915AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 924KB
SHA256 d72dd5722aab8d28bf16f207d4eccb8a1f43d8d670d1fac79730dba407536200
MD5 fc62c6dd30b94b9ec44e4510170d9753
SHA1 627f3568da90cbaf7d361cadac12131fda079138
SHA512 7424c3c3a8a8c64dac5829f7b9e3cdf0d5473e276c7c27044a7eff9ef65fa0cf285799055ea7286001e15d35d7b0e3aeb98163ce6a51b858c4628b8ff99b7f0b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy11u:A3k03kHRJp
TLSH
T16115AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 924KB
SHA256 ad4472fee9fefa45c7dca44cbd2ea199557dd4340c0fe5632617687dfee4cd15
MD5 1b54c6ef45201585aa85177f7f9042c1
SHA1 59f991b67f4cd3dc092a36ecae1d854b6602fe00
SHA512 7209b59cdb3da71c5a8161cc7cb62ce5ca84842b7ef32b569bd780bdd9ac68af7098676cf3adbf2716776313573ce264ffca81181afd118189b85050fb1bc44c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1r9:A3k03kHRJE
TLSH
T1DD15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 924KB
SHA256 0d656e020d123d34cbc57c40adb65a45199a29a5617291c03f556624ac8a31e6
MD5 4c014f2e080e517b562b345a15ff5324
SHA1 1b922b25d610eeade565314a0b2c44f4bbe53a0a
SHA512 e2c10013deb9afe6299dbceff81f50c0f4411aed4ad7e2afa5e1c304f55d6a0aead6b5cb744b9f111f81dfb5d20b0a26141a15d5ffe51d25ae2c09082f659fa5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy13c:A3k03kHRJt
TLSH
T1F815AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 924KB
SHA256 8b0925c52fa2d4f86498835b2500069c3a303feb58af145800963e9f208279b3
MD5 fe2cda818b83a117dc07d784b75653b9
SHA1 d5983a42b77a2fbf877fdb6280afc08d820ddca2
SHA512 e2b9f62ac25a638512077a461d30a3c0b4fe1cc95946eaf110570f04f84985dce6524d2361b749ccf5366fd84c9c1615bd0259d6b500ed8fe0d82a41b532189d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1Ap:A3k03kHRJz
TLSH
T1B515AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 924KB
SHA256 0409e93132800f6ce89f33dad2a782cd74a909a9ccf7889fc12ee86801a64cdb
MD5 9025001f2bb33d43686a6bb42660e310
SHA1 40be6d66a5a9d8529f1776eee4fceeb19d02e859
SHA512 f26f260590afa70cc2638bee02bffc880a4a421b80d6eb2217f7323071147ad0fdcccc5b435d00c0207d7794b29a66cbc4273f7fb8c29e03c6de096ff8fcc67c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1HN:A3k03kHRJI
TLSH
T18915AE13EB9504E9E10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 924KB
SHA256 f331a88d9783a1bacd9950fa75ae4b043fa4f71557ca0cb5da27679e8a106194
MD5 01d7e7c2fdf0e8c6ecada87440e1ae43
SHA1 ed87972a3db3d12cd01cdb0c37172310497c9518
SHA512 5cb04f3fd87167db9f8ed7707c283f14cb1e1d0d527713ee77a553e60ea338bab35cf62b4b6379b73e8edce2cb917a6e2e3b2fd2706ba128d4b9b47d46703135
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1lF:A3k03kHRJe
TLSH
T1AB15AE13EB9504E9E10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 924KB
SHA256 2f590e5a598e476c864e834e93f815e7740f866481e35d3147a9ee840864c33e
MD5 471a3b5ccd14ae97d3e63e441a1423ec
SHA1 024019508781f06862a54ce80503c553ccb699eb
SHA512 3de02f2d81302914b97ebd64a36c291cdd3a4c6f41c693a7be3e2aaeb1c556308b27bada7ba9f7958da571b3da88a261e4c6ba6118f2306aaffa51aa7c071db6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1GC:A3k03kHRJ6
TLSH
T18315AE13EB9504E9D10AC1749AD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 924KB
SHA256 7d1e543347039cd2c1d8dc6669ab6c57b3d069854e9d08302d5a0f36ebe3f0c5
MD5 71421f4d61912b64f05808e399307cda
SHA1 9a737f6c1817f64ed172651d05e0ad4d22765a49
SHA512 a1ce63bb0902c286d8db58b975af88bf7aaf57b7d33431feba611fe823d67c11c5cc05fa06e18a98d6f9d79ba35cd597610e8e88b946810a76e35c34a69ca8e6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1Jw:A3k03kHRJP
TLSH
T11D15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 924KB
SHA256 babda9aeb2b239398c4063342c234d907d322f010b32f8fa942011e26e6ba873
MD5 990d92d7826fac2cf672591f9f32c305
SHA1 9766ad14265760c8af50d9b1b1ee5f6ad2bc45f5
SHA512 687a6aa19ad6ab0a15c5eb5007393e9ee411f375a7457bccd91384ca6a669f7deab43b21ade90617070be8e8c61b25c7d0ebb71de4032148e32953260b48a704
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1QT:A3k03kHRJr
TLSH
T19115AE13EB9504E9E10AC1749AD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 924KB
SHA256 af4ca242cad1c5cd42490ab1e7d66f0e9b0939273e576beedb48b8d10575d98d
MD5 88986c5e77c54f2159a87186ad47400e
SHA1 e8f7dd2d100f4d82b9efb59d28b0ff9826930a7a
SHA512 84109071441dd02fed5ae5b819e885f84a61d380c12d6365202953ea8232aafa050fefe09fdc7eb48d01a7fd8b78c5db1f1871f87b505dde068276ec09ae7fd8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy18u:A3k03kHRJs
TLSH
T16A15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 924KB
SHA256 38cabf07a377dcd665367f4bb2d4bcbb419c3846620a1a026994908643028dbf
MD5 1a27c23db438089ed2fad69deeeb178a
SHA1 4d458a03e22bee5359965845ed3a304150cffdb3
SHA512 599a17e87bce3948bb990c45d37089071dcc55ad280081365ea5484df08e3c62d28bcd073a4c22b31def932a63a58545be2e7e1ee49d5a52ef32248223249387
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1ab:A3k03kHRJF
TLSH
T10015AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 924KB
SHA256 1ac378d5da2a8605909bf914ed1daf74312a10437f9cbc0e4ae670dc96559796
MD5 f965173c0a0844698d7195bb657051f3
SHA1 7c1ad1e214b9ac9284c423b306bbde09732b268b
SHA512 bb1dc213c9b942f43b0c888650acbe27335b9b84a38198f8573133e992d35ed5f75f25eb72fdf89247782d2461a06bc49d8376d1e0abfda525085a161ccfb4fd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1cf:A3k03kHRJF
TLSH
T1B615AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 924KB
SHA256 9a98cf45d584959bad728c5b4f203bbdf0de21e7bffde3609f395e432c735c09
MD5 211c6a138f34c3ffaafe3f33c9324c90
SHA1 8b416c43ecbfafa0ea5f9a13cbf8c210132815b1
SHA512 8c3593c0ac15b61e43774e34a944104eb8b08789d323f717971dbffb5da38ccfa3dfc825957c69adb74adccd4b8a23aac05a6585bafdaad2657c28a8fddc2097
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy15K:A3k03kHRJ9
TLSH
T1AF15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 924KB
SHA256 df780b31bf020f10ca6f2d6bdef9132a05381f37c9743c85d57107700e1c3593
MD5 e58556a9b62ce6964433c71af848ded5
SHA1 50bb4a64283f61b16a38a4280edd90468e430b6b
SHA512 579bf9dc057aa24af96506888a50b2f4cebd3f13dd390fbdaa2f939a76e402a0e5c9844fedf4f2db59c7eef54f1889bdc384fead51fd14e1e3c654654fada3e8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1ik:A3k03kHRJU
TLSH
T1C915AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 924KB
SHA256 31833de9846f5986d744d09eceb299b0b5b60f448b8c3f9c0c5faab696debe01
MD5 a872d1ff7bb0bc7ff1bf672d111f90e2
SHA1 3f1915976f18f56cf10b57f7f16cb5f25b48fb71
SHA512 6f4caceef91e219534d759dc69cd4ebeefc79f2db465328d40cfbc6a6aeeac39e6a1b92881500d24e54b6f53c020200c00f048e3f72834fdec87105bb807c9d2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy130:A3k03kHRJd
TLSH
T1C615AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 924KB
SHA256 5685735833b8f97df8a213e49979ac3526e0be9f02117903668c045034b14aa5
MD5 27c6ff043047dcff07ebb0c39e15abe3
SHA1 79cd0352da97977e6f9e22561e20d339a01794ec
SHA512 2be010c5c9da6f8e48349e27b662b89491785a8ce18c3b6e8c616b28fcc9bb0cbc5d1c64bcee3f33be34d8f0c8a750d495b6281df813f582a23e753a06eb16ea
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1mg:A3k03kHRJs
TLSH
T1AF15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 924KB
SHA256 0d4044ace84ccdd26ceef5665574cc38a33ed8eaffa28916f863ee2c17af715e
MD5 14f66fbd1d110db64593140123169bdb
SHA1 08e7605c6413a7f754980b7b1557698b58e3313d
SHA512 d6d0615e4a9f67f7ce50755f9cae9659b94f79620cc878b459499aed0ffbe3209a225143ee8eedb4bd90e80c67fc0a93b331f91ac3dcce9654095d005f0f182a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1vr:A3k03kHRJ+
TLSH
T1D715AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 924KB
SHA256 2634e552f23813a6ca38627afcb3aa8283b341dc3bbb7789354fac46b646c25f
MD5 ea412a6a003d40d691f048c7f8a223c8
SHA1 43523f42080d9b6385ad3b3588f071cab7ed73f6
SHA512 5565c9701bb9021ef8cc11f65284b039c6f0b2eda82756bcd82d2b5f0f130bc13a0759a5245cbe1d312433d4f24d3a8953e760e53000eba82a33c29c7bff8aab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy15n:A3k03kHRJI
TLSH
T19415AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 924KB
SHA256 8a885f158197cb41621364bee969a21d1c4b9de7a835e2cdd5bc65df062fe1b3
MD5 683f0ffb605ff76dedb110b82f3d4a21
SHA1 62c33bf5de411c9721a0aad89545cf25bb433dcf
SHA512 7b8ee33cebbb894c692d7e29a86a45165a75cf3883d3ce0fe282411dbd0dd2cdab8d9efd8f136dc8f5bb12db98f0670751f392ed906d4937d98da5bb00e23d3f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1Vx:A3k03kHRJe
TLSH
T1D215AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 924KB
SHA256 6266f567fc4254411ecc797a54d95cb6fc06b4fe4626117353de67e94d98d6ca
MD5 3164cf8ba4ef6965bb977098c4fefb26
SHA1 e767c6a728cca2dfa3d729f4bb4942440866872f
SHA512 73b4d707aaed10ed8c60323d471b523f13076860f6ce75d61ecec9b25805acae690a69c6526d4fee50968e01a6b73e6ac3d140d9b6258cde0014effffc85572c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1LA:A3k03kHRJV
TLSH
T1F015AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 924KB
SHA256 9e97dccc1a40071647a600c0d1c0d6d2182eca0323568bd5d414c7bc93b9969b
MD5 1da72f408eea280c86ea8a7c830e7d12
SHA1 6405360fc0dbad7b1dfc7c4105a22256590eeca4
SHA512 359384a98603376fc65f6778c13b8e5df886a36280bd2b9057f2bc9d5dd49bbb2c7c6a5b3d1139c32a5eafb82d32d8eed5b3d495ae8094e5a48a7875dcdc4c81
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1c9Q:A3k03kHRJU
TLSH
T1D615AE13EB9504E9E10AC1749AD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 924KB
SHA256 5bcd1772bb31d47a414c122daf09bae2325d78a2a01f28e379af03264f904e26
MD5 2b1698291f5d178b605e3574ffdd44c3
SHA1 c259fabd35f960fa8498d71e80394ddbfabb9fc5
SHA512 1a7df2de063b7e914d2764dc7cf69b9eba43e44748687d6311c6c49f7809cb5edc5a8bbd8152ff40f06746fce5bb97871ad82cce364fa9ef7c90ba8b7cd66cb2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1F4:A3k03kHRJf
TLSH
T14F15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 924KB
SHA256 661fa02df6d79c632d7408bd8d4d8f57f08626fd2b059475775b4cc903291857
MD5 5df5dcf9e23881a5b3e2a00f89488d48
SHA1 a20c0b83f873ed0209ccafb5ef2ba431ff790688
SHA512 9f84cfb82dde651628e44bd2e356a5155c5734605f31177672a8ed2d01359dff78c3d758e18d2c59bd8ba2ed7f1887cddd934635da2a495f2112d556a2e84cc5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1Qu:A3k03kHRJS
TLSH
T18915AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 924KB
SHA256 b507e62e0317811ba620b034f8814f8caeec74e3bb32f61d8b59c49722356f62
MD5 e23c60f8454710750bab07f9b953f4a9
SHA1 004c4df7297039a6f24ccd0f7c5c6c5576170f87
SHA512 5acd47d23fd2e922dea5c4c967fafd2c82928aaa83bd28b5ad23f1db4a99b4cd63fb3b344912f0c32a892ad8619083a04fae8d6637488a781d493f26bb904e24
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1Rj:A3k03kHRJM
TLSH
T1F015AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 924KB
SHA256 151eceec6734e954854c7bf5cb0630fba9ca0be4ff3290a93e335177757e1d59
MD5 74ebdf7fb6b7709726e46b93df315f15
SHA1 0e5a32d990eace8866a5f7b19986ad8a75059a86
SHA512 77baf5de57bd336ef02fc4647ba06475ed562dad721596123aa38998839526594863815916ac882c59c474943b69ad3c831def10a7b200b2316cfa8a1deb2d90
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy14g:A3k03kHRJE
TLSH
T15B15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 924KB
SHA256 3be6404aa0890a4958ea7fb95db4b5e1b41780a0440822dfcbc8ba6fc5543efe
MD5 7b5b89dc739c5edb45512d7341bf7bd9
SHA1 b29c319bf89ac7e05ae5560e8e5836537c9100f1
SHA512 9987db45d5ce0dbfd2230916eec47a60c648151c9d0dcc8f0caa00586f25aad637ae1d6423e6c9d48f8bcb8870403494eeb9c485ad4fcead8a5d96cd550e8bed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1XI:A3k03kHRJt
TLSH
T19815AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 924KB
SHA256 363e371c8e9a0d4a41cc4d7c1e4be28e478ef664c95fcf0170d7d5fdfe6e34d2
MD5 5e6ca297576bcaf9f7ee9d2898a2b919
SHA1 e2378f04f698c94dffeb867009f298860dfe7339
SHA512 9cf80299dd591d1b6bece93ee67b50f7495e0199642e4f260e30c9e2c7fab5b827060b10dcaccddf0991b7cd869a6b0c02950531c666fb3103506d53483462af
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1do:A3k03kHRJL
TLSH
T10E15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 924KB
SHA256 6c7a1ab8e64e719d69d7c17f7982847cfe8ba5e97a204afaabb6540375334e12
MD5 3f53b1bed6d0d52ac929edff38bc658a
SHA1 c62ae0b45c04165bb262a299528bd297fa6d09f3
SHA512 cbe1f354736c4bfdaf7d28334a1db99f2743bbbcc65b483a7fa95075156c23d0440c3fca2fd680c129fb9c03955d24e440ab97506409e31a61dfadbe4410d951
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1O+:A3k03kHRJO
TLSH
T12115AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 924KB
SHA256 37a368a5fb4c8de38801bbf0c17738fce2251a1e6303039822e69b9b6ae19922
MD5 a96c8bcc77de8fbc40e88d173f300cca
SHA1 736acec6280c28941a2825e9d1e520b95cc4e827
SHA512 56e7fd062f3974b0eefff6200fabdb0e5fed3a64bab94d6ac70a40d7922d74e8fa1b76d8173d07bdcbf6d3a9d8dfd8688d638c1a6e5bde7de35450df6ec4c221
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1OQ:A3k03kHRJ6
TLSH
T1D815AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 924KB
SHA256 3996bbb80a5486fe72607e908c5be0634427ae918db7b9475809460c71ae2b0e
MD5 5a460e87b93bb6a40d2f21db36d9cbbd
SHA1 c5269943b715777e093a934b63128233d09396db
SHA512 ad6782a5361730996ac39af0a42d0a62313632180ea1ab79645fa9ebf7476a91a5154bd68bfc6c44675575949c77cc146f4877782879ef0c7e5d18334d651c9f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1vX:A3k03kHRJq
TLSH
T10E15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 924KB
SHA256 5739077bb0bd7fe4f643ab63e6a5c0e474730e4f533228c52cf66a8e51c4d83a
MD5 02397e5e4655324f9d036c4fcb26c558
SHA1 4aba6adc8955460dafeed9672eda987d34951823
SHA512 4f90f056de840fa2f6926020c634664156585101a7392d0932217c525010ce8e425fe028162623ae47acfb80ff6ae1fc0d68adf2c871007dc926c5289d951f98
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1lL:A3k03kHRJE
TLSH
T1BA15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 924KB
SHA256 a699d578e5ad402685cc0ec5904e51c0f834785f674b5a41fa85c256e2ad024b
MD5 e62afb7180431d26101752e9594bc1aa
SHA1 c4ed09a1421c8b803bab6854e5438663a00e179e
SHA512 33672bb515b679ee6836a2cdede81091fe47568228d4acc11064fd7adbef494eab57dfb63e74107a12caeca75bfefcd4f72af368ca421b11c823d59ce0806dfd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1DM:A3k03kHRJF
TLSH
T1CA15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 924KB
SHA256 eed09a861b83196ecd87111ca0330fd3251106ad4df10e35be6a6c360a9564f8
MD5 4406c04fdbb83a07395ef819b089cf48
SHA1 b62743108dc8510f371d573b2315ecf11cad9147
SHA512 ca043223674303b29c16a169ebc70439adc971c254d14d490583161a2cdfbee9892a7bd3ffb5cb74ac7bf37a658b345cc5f82d6c09a9107ecade3e5fafb74be8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxy1Eh:A3k03kHRJf
TLSH
T1BB15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3340-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5672-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5672-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads