42a9b4f3ed95c4e85e4f2afb4a5d85bfcf1a148a4e72f13efa35584702b49fb8

Analysis

max time kernel
110s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 06:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 838KB
Sample260804-hn268aytex
SHA256 42a9b4f3ed95c4e85e4f2afb4a5d85bfcf1a148a4e72f13efa35584702b49fb8
MD5 6ea2ba83ee4710df7b01269300cfb861
SHA1 1bb4b5a0427ebe770307e401f9679532b9c5fe8b
SHA512 c966691d4ecd8a416b52125ef2be374aeda53048a798f849d3053d013c4e0fc88a5b5b10211f396ece7ba53a903b4f18d4da9bbfbe123cec4940d37e676b4c9a
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3z:KIifqFu1//IifqFuyDA54GX79lSjuD
TLSH
T183054B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/1812-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c529-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e6-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c6c-58.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001895f-198.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001ba9a-252.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a3d-295.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a3e-470.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ba-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bb-580.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3b-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-636.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-721.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c2-789.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-838.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-851.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-870.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-889.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-896.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-915.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-928.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-1002.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-1045.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-1076.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-1119.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1163.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1201.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1316.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1329.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-1354.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1367.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1812-1430-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2124-1485-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
2124	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1812	2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
2124	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_6ea2ba83ee4710df7b01269300cfb861_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1812

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 838KB
SHA256 42a9b4f3ed95c4e85e4f2afb4a5d85bfcf1a148a4e72f13efa35584702b49fb8
MD5 6ea2ba83ee4710df7b01269300cfb861
SHA1 1bb4b5a0427ebe770307e401f9679532b9c5fe8b
SHA512 c966691d4ecd8a416b52125ef2be374aeda53048a798f849d3053d013c4e0fc88a5b5b10211f396ece7ba53a903b4f18d4da9bbfbe123cec4940d37e676b4c9a
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3z:KIifqFu1//IifqFuyDA54GX79lSjuD
TLSH
T183054B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 db8c0fa15a0744f871106b493dac4cf55940445107de7c12c2262a221cd4a6d5
MD5 b0167d06053c92a50a58c11c6668bf98
SHA1 d1768955c6773dc6f744266ce9383b0800a72917
SHA512 9a97bed8a09e4fe2bb24c5879b8fc49aa533b76ca717c7e760d5ce6c1a85272d52aadd3953254bf50d9f1d7a9433b4b38070878b57460fe945a3b2a0e286a5d6
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSju/0Le5ji0hmxNrM:WqFgqFUHVPji0Aj
TLSH
T114653A16F2A44278C02FC075C7D29666FA73785117F096DB13D4E63C2F22A919AFA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 853KB
SHA256 20ac329504001adfc8bd6fc67eadc684cbfc25552b2dc2faa987fe29e6c32435
MD5 537ca773e23d20fe2a9997e82f4aef96
SHA1 8c3258870c8be389b59deba9f4610685b0e79839
SHA512 0797c2560924b3ca6a979c60269665ef8d9cb38e8cb5355ee64c966750e3fcfb039e9c4677ee436b8c8e4237fb56e05f6b7ae266704fd8c75909db2d3598a633
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3xa:KIifqFu1//IifqFuyDA54GX79lSjuha
TLSH
T1FC054B06E29204ACC55F8130C7A65372BA73BC2156E0A76F13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 886KB
SHA256 fa30bbae6dc4c40d96901859e5ae65b702a8cb7491e5d482e2cdf2f4023b28ca
MD5 90efbc4f6c091e3e83bb1ed28f090bee
SHA1 42ecacb85a55872ad9c411a4702baf0628ce7a1f
SHA512 f43e3812a13bc11e78fe2273fb721df2b9e7990ce8cf7c85ea06ca5c62404ee7a53aebb1c19bf643b49966ba056a9e31911de7542d891ec1d452337e060289ce
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3Sb:KIifqFu1//IifqFuyDA54GX79lSjuib
TLSH
T1B4154A06E2A140ACC55F8130C7A69272BA73BC2156E0A76F17D4F63D2F31B905EEA717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 862KB
SHA256 63929b7078be3442d1e34b522a84149d15223351364da04fc0c0dd187459f833
MD5 8eb49005e5fb4969a625e7574dddc727
SHA1 afc085dc9dc4ad7217d774697c508346b61107fb
SHA512 0324bf7f9adcb248ffb5c330e1d8a11bcdf9c37ac2ff18cf0b4c30a5a8dcd6f11fdcbf857d46180adddf2ab3ecdc4ca635898e7a43c97dc480ed8c9161a90033
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3JZ:KIifqFu1//IifqFuyDA54GX79lSjuZZ
TLSH
T1AA154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 862KB
SHA256 dd925855f59d6c2906fcd45d4f4535d5bc560abb0d5894cc059435d152c6ef08
MD5 229e231c4dcc2e527605830441bda23c
SHA1 543a1789e40d78a0caef84d0df4ef502136e7168
SHA512 01b9aeb09ae457711c00001859bdc8eb834c422e9d8a5054fe25198546af45b9e4a9885c071689663c015d478951a6da73c9c4065d58a32e49adc8d3d9609837
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3i1:KIifqFu1//IifqFuyDA54GX79lSjuy1
TLSH
T180154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 862KB
SHA256 51bce408eba2f1ab951c7d48acf5be27f54a75115bb2cdb573a028c1bd8aa683
MD5 e3f881d22cd7fc5de8fa1eec69843cf0
SHA1 e628d441912213326f29a0bb42d9f2464f47579c
SHA512 b40f035476f5c423a7a10081c346a80df6c57ddfad852bf7d501be73021fc81d3773e7e635194c0c8982750a5524e6f42fc48955a11bc3039725acaa8958dc03
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3I6:KIifqFu1//IifqFuyDA54GX79lSjuY6
TLSH
T1AB154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 862KB
SHA256 6a8bae01761114855e71a90518c937b3719e986ea0a524ea48c952c98c1f5034
MD5 edd0ba7dbfaa734a552673a9cbcf0081
SHA1 d9c896509f12e5a4c361b84afacddf2afde54719
SHA512 07c13cdf00ae1e66db5d72e57dfc67eb5cad2baaf41b118880bbae7d578d7958bfc08ebc7d9f0890022961ebf4e5aa90184f853206cec34bdf7a0eb5f4c73552
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3MN:KIifqFu1//IifqFuyDA54GX79lSju8N
TLSH
T1F5154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 862KB
SHA256 b6eff413b6e28927116ef2b6d98b362a1b66674a8f4a706bdf93d63380cdc2b7
MD5 c4ee7685313c860ee242249c421dba3c
SHA1 0b26a921e06277f48a7158cc2555142b5dafcad6
SHA512 5aefad9324564608b4afcc8aa3b3b4b96032b5f82a85d297e1f02e51023b6a476bebbf548496130dd38fcc3739eb94f805a6dedd6d9b4c55eb7ce3c0147baa14
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3Cf:KIifqFu1//IifqFuyDA54GX79lSjuyf
TLSH
T10A154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 862KB
SHA256 efd3111fa17d6831d605d367349819ba16289fa1195a6234ecca6fc5a83aa1f8
MD5 58953c8b81a4fa50f1942a98f5eb1377
SHA1 ce857a22bc47c8787bace48346f9dde05386d125
SHA512 9f3c06ed7c02f4f86e007c7d27751c7313ec5bee345af0c3bae21b462c991dec93534e093a6771f164553a42b1ac40188770a4b8338222196f8781d6cc629169
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3co:KIifqFu1//IifqFuyDA54GX79lSjuMo
TLSH
T1FA154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 862KB
SHA256 09e705c6acecb0723c42f4be7cd555437d1578d114d36be96f3a4ddcb59a679f
MD5 69ba6bf6c970bb36e8807efcc23f12fe
SHA1 2be3a2b2eef1211b2f766b820392d7121c6e9fb8
SHA512 352affb5a44241401b88644c56573fec066b733f6e8ddc9edd08e9719d7f489be2c6ff476460f1174769bfae2f7699650a8eddeba55cfc995dcfdbd37cbed836
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf38u:KIifqFu1//IifqFuyDA54GX79lSjusu
TLSH
T116154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 862KB
SHA256 e224469ce7852c4c7953fa41b8e34cc0be70e5a56f55ac7be806e18a142c2c6b
MD5 e0dcd3bd1b3d2356c9ef826c948a7739
SHA1 9581f98357f51eb71b56800897907844e3b0ed28
SHA512 786bfc0b601b91c484755e8c75521f32174f0c2c1c17a9b9765edd1b43368506a73097d8184af62f1066faa4c7e2e3b2e2810df4f7751d628e1a1ef9310a8b23
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3A9:KIifqFu1//IifqFuyDA54GX79lSjuw9
TLSH
T13E154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 862KB
SHA256 3016ca64bf3424251bd9252439be9c2c2a114286d4b25955b2dee1e59a376f67
MD5 23c5ec52ac382b3d8a3b05e6445a8837
SHA1 67bdb6c42256b61bcd958b54eeebdf64f23aa609
SHA512 5dd579244b4e9e34c82cdf7fc1a64a0fa411c5c527337e435e4bdea77e67f5f97ff07fbbe4a96a6b956cca76a0b6941ad5c0808a6bd1945143392537a657c58e
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3Ic:KIifqFu1//IifqFuyDA54GX79lSju4c
TLSH
T183154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 862KB
SHA256 b77f2f975e6ca409e605d7b7e4ea5c3a5cbaadce9020b7f83d3940042e18f1f4
MD5 376d56e2a0221222c6e848c5b1245e70
SHA1 19983076d51027fedbb1aec94d4797545326930e
SHA512 7b139eb433a0f97b893177b2052b9f6c17c0b66b90895f06dea335ffd92a5ee49dedee96607bba7c2fb0364129a64060262fff21ae8579d2175eea8066d310bd
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3hp:KIifqFu1//IifqFuyDA54GX79lSjuRp
TLSH
T157154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 862KB
SHA256 ac9ea3289cc43010a6e04465a6d10c0a1da34198d2757b9f844e70010f99f898
MD5 617dd2938c754fdf89bc125db30fc0d5
SHA1 4c0b552b437c24ea28cf3f120352e4359b83da8c
SHA512 68f4d65abc3f0c67e6f07132f1be014070a0d1d9dda1397ff45edf98e20b99a1fe5bff7b662945e278669783364eb65809db81fbf6735ec9180483ffa34d4742
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf320a:KIifqFu1//IifqFuyDA54GX79lSjumN
TLSH
T1E8154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 862KB
SHA256 a85d5b9c6bea2a4896e3ddca7df802ec4725f9fca2dea8006664939228a2815b
MD5 5f771faa4e976b8db0e2af675f52a459
SHA1 43e50a66d365b0e262d379c9ce5068407f54cfb7
SHA512 74020e7addf5e30b8e8ebf9c17e3dce33e0848ed6b0638ea1b2c02548a65743a5b8ca234af047b4710ea2f7ce4dafe859e4d84d9ee6d209895fcc1b1737dad98
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf36F:KIifqFu1//IifqFuyDA54GX79lSjuqF
TLSH
T1C5154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 862KB
SHA256 554b72f74a7d86d1a614906c60cbfa2aa6fc70d6fb8ac05efe2448d5e14ce8e9
MD5 a78d4ccb33b78b772c4cca64a9f4cf26
SHA1 4e2f850acb36105260601f49741b03e663423bc7
SHA512 cb3ad7187dca4b37d68112723c9afe9e8186164b7706cd91a207703919a4a162f6d58243c7c23528b7dabe1de2bda130e824e9d43bee1cdfea204507bad7bb92
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3PC:KIifqFu1//IifqFuyDA54GX79lSju/C
TLSH
T173154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 862KB
SHA256 971effd046767b05c3cdfd5012b58f567f9e9604e1fe135e1b6cb8ea8cd413b0
MD5 01f982fb649b17eb253e011a434f2b14
SHA1 c1020802f9f0f24ac53de7cd5d66c72199c83222
SHA512 b6c9a4ee70f08fa9b15f69542b25c916b0764f77ab2c3f4c4256502d4fa56601d058f34fe608481d8910d99dc91c4831c3e653cb8487e833c0c657ba5e6881b4
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3ww:KIifqFu1//IifqFuyDA54GX79lSjuAw
TLSH
T163154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 862KB
SHA256 d0e3a4e588adc76abe257980476d1a008d817c0503bcc6b0061ca979f938824f
MD5 b8a8bc5290119103fda714ee8228c3d3
SHA1 85e7a239e4c3d7d52222e927911cb7502e49ee9e
SHA512 5489c60fdef400fc4cc2bc6258c381b7ced5ae289658652c5e59ba90468530ce0fa31030edd851c2a1a78e97bbccbabcd7a67028ba11ec2fdee048112a061c85
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3PT:KIifqFu1//IifqFuyDA54GX79lSjufT
TLSH
T10B154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 862KB
SHA256 af83cfab8c0e343ee2ad8145940cfbdd4c0fe8111fffce09e569e214c3d1fe88
MD5 12f26b7b8c1c69e80fcda0ed71473911
SHA1 c81670592b37bf7ecbceb02bdc72dffd9ba01d24
SHA512 a2372e88677bd8b60c827e8b9f64d4df6ef6a890ed942dbb8a308239ddecddd589c7ebc67d86d21082f70bac197333850aa8a2ac1c890b9a7b930abadf737ed0
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3Ju:KIifqFu1//IifqFuyDA54GX79lSjuZu
TLSH
T1F3154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 862KB
SHA256 0edc587ee16d17e0fa9fee1315fa4624a852c55ebdc15a948ab3ee87e7f329da
MD5 d9639d0bd7d87a7951572cf43564a64f
SHA1 1119facf3d0725870614903ff507d1a3ac71e511
SHA512 313ea2e51dad99a68bf3f9cbdaf9302f6112a868d26d5d4e0eeea7d4133dcf4eb7ab5d238785ee24f5bb98a53f316fd036f4945f13a629641aac9d78e796eed0
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3Bb:KIifqFu1//IifqFuyDA54GX79lSjuRb
TLSH
T176154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 862KB
SHA256 f6aa42e7293537cc5fc0bbb381b21ea27195bf8a852e3739174bf01e2e73458c
MD5 638d17839a83a2b9ffe6df739a66ce8e
SHA1 5c4966c83dd344c9a9638e48763cebef2823ed3e
SHA512 490221076c486e9e46333aade159046d7f86be474ee0ddc185d36ed039fb2a0e00077c453457f9c5799dcae8274a555589dc5b4cc5032dde9a5b1192fe1395c8
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3Jf:KIifqFu1//IifqFuyDA54GX79lSjuZf
TLSH
T163154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 862KB
SHA256 a6266905778fc4dcf7bc218ca2afd1c8fb7017404840ef27b1ac74bf91bef447
MD5 4146425b74ac5f7af68abb3f98eb4840
SHA1 339ddce7a6e15bf5f834a2bfe1efad0c31837c6c
SHA512 18447e33da6abd8b9924864954f9b166df8171556dc74c97f481c8fbe8d722a724d893c9a462187b985ce5647e425808d50fa3443874957f69989cfd231a08e1
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3yK:KIifqFu1//IifqFuyDA54GX79lSjuiK
TLSH
T108154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 862KB
SHA256 514ec66d2ce80afe80f423abfd8dfb9d87aeae01e6947aba2531e19d64794d61
MD5 394bbe12e214b47812dd824943535d3b
SHA1 797436717b3d73c1a78fe4dda56e151c1e6f313c
SHA512 56fc5d2159ed3b155b9d0a12faeb9ca4805a6c37de37eed31d7a8e31a57b178e59794c5b6da9b4efd02022153939abe52255989c3e577b86191952a2e72e01d0
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3Xk:KIifqFu1//IifqFuyDA54GX79lSjuHk
TLSH
T18D154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 862KB
SHA256 dfa2de168d73e47bdfb46193de5c5e000e28e89598fec5d35b8de126bb84b888
MD5 aea61857df06dcb6eef8ceb29a04f93b
SHA1 7461a063a80c1d03ef54f594c879200dccd23f8e
SHA512 c044337f2eb5f65f510f0ea1721f0c083bf3645269026e549e356821b7f849f507b4a37f5e5223c0ce37ecfdaef5e6d035f2f38e96f512b3c442f564fb67c584
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3g0:KIifqFu1//IifqFuyDA54GX79lSjuw0
TLSH
T1C9154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 862KB
SHA256 5ca0ee05a0ff50518cd5a95f680a40c909b5568c84c458b47e78197a195cd2bb
MD5 54b709856f90baec02f0f213bc846417
SHA1 f4a0f4e933ceecb3a77d1f7bf5d560de60b756d4
SHA512 bc05460b2df0ad4ebafe21d0a46200bf6826720f9ca0f9377be694b1cfd465e4d47d5a34552e9278f56eec8e1ffbb9d44a2dbfb135a0c9bb6dc010cc8f2864c8
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3770:KIifqFu1//IifqFuyDA54GX79lSjuLg
TLSH
T1F4154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 862KB
SHA256 aeaa583f8f28a74c3a2dc663c281dab89191c6a54c13ece0678525eb97a563a1
MD5 42afec1a68134bef4814cf6799dc523e
SHA1 ac0dc9cc0d21158f4fd9d3d756baa8e6dbba9656
SHA512 4ac6f54fa49fd7e7a4d1d53d605508f959b7c45746ac2a5a0c2a03ad7096d29af8fc51eba365e1b49169e4fa0a11698923640c7b95c0182bbd75befe4c4e4057
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf32r:KIifqFu1//IifqFuyDA54GX79lSjuGr
TLSH
T19C154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 862KB
SHA256 1a9c064ddce63807a9a29a4b89dbf229d5b52c18f8544644d100bc21c0496861
MD5 212b7c7e497c54cc5520fc641a150f49
SHA1 0e449c0508f69e1a140d53ea2373b9a0428de46b
SHA512 1fcf9a0aefe082f0ef2b88bf26bef0fb35dfe2b1cfd005357681a67a7b2e279696dffd9084f127c08d6df5ada15331f174afd28177e9a68bbc2ecc24cc18de89
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3cn:KIifqFu1//IifqFuyDA54GX79lSjusn
TLSH
T1B5154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 862KB
SHA256 e51fdfe1e2d9e34612d411be4c0c2074edf75410fbfc88d0f3068548354594cd
MD5 18fb09492262f73751c5e9b0ceb6f569
SHA1 1a09992eaeeaaf3f1d5bbeb901b7d4ae9240bad0
SHA512 76c9405f836ea03e7034c8403d726416400e1fbb7cbe38d658ab6069cff4d2cd0b2be94c666c9321dbbce269d8b7bc7c7369d43d8591643260fe20a29c9d824f
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3ax:KIifqFu1//IifqFuyDA54GX79lSjuKx
TLSH
T1F9154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 862KB
SHA256 9222dc5e06d2c36e8cb25815dd1eb71cf9d557f23db6da85a70a3d98c1403c32
MD5 bbf19eb1cee15578a79b8c092e8ed4bb
SHA1 d90b6781999cdaed058f6e662b9c620d6a9b63fd
SHA512 c698239dd84f3850b95f5c3a8215d4a665d25130e7ca64573ef462c5619a7a1fc8eff4da3cbc84b4ad9bd12b3a1f7327c87ea9ce0fbc346aee2d464cf2adc31d
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3cA:KIifqFu1//IifqFuyDA54GX79lSjuMA
TLSH
T185154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 862KB
SHA256 95cacd56891019a6f739b4d3965ac4ff5bd03beec2f53ce733598beb455cecc9
MD5 361f8168a3d74d1f7982326379a5bf32
SHA1 15a95d9758a7227a45d183da555e4f7d1539ebd2
SHA512 18ba8331036e994102e2365eda3284259b4b711028f60b5a18d6e22358c53323e972ef2b0bb9c16248b3ec42c73e96843e4a8c125a4ff2a7c359aad47119b7f2
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3F9Q:KIifqFu1//IifqFuyDA54GX79lSjuV9Q
TLSH
T118154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 862KB
SHA256 29af675d7936ce2c04685e98140bb3bc47a679934dcde637e134519f0d9ea995
MD5 2366bdb29ef4117971632e4b8fc8e7b2
SHA1 a6966b8995a2cf66137f52868d3a8b216c072892
SHA512 9296bbb5516bdc30812e3858be98e5bf5497547437e61820fde7bd2b0222a8785d72b13a05f486f8a0e47c3ab4c923ae93a607642839974ed94438d3b9645a54
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3w4:KIifqFu1//IifqFuyDA54GX79lSjug4
TLSH
T116154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 862KB
SHA256 42ce6e57699c0ca31d4205996e0093ddf394c5f8c1dba53456252a1a5b6c3dcd
MD5 2d4618cebf3c1ba28f51f967f3fc2666
SHA1 c2c77e3b31a98a2954945fc705542a81e18f872b
SHA512 13d09336a450fd3dad2e79d76f35b7dcb42d0683022f67e1469a14b169c82f81b200c05bf3f9e66dbe01a087e322cd23ee3abb68ef9bc8acf0299ac9bab2044c
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3zu:KIifqFu1//IifqFuyDA54GX79lSjuDu
TLSH
T1B1154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 862KB
SHA256 a73dd4d9178c7fce558c370958afaa2b8068833cd8bf576d9d729af190ae410d
MD5 24f1dc46fe423668ad90d66e8ac77463
SHA1 ba93e5497128faabbb413b78a780e0b61b31f74c
SHA512 3727aa21ee40537b686461256ee10535b30daf7e953105f840a9fc1872dfe206f178adf2b564be3611c6a7fb7ec09428d54d0b9b9e020c05b597ab4544e7628e
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3uj:KIifqFu1//IifqFuyDA54GX79lSjuej
TLSH
T1E6154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 862KB
SHA256 2e65b65851613ca5bd8047243a4d27a264ada3c6fc72d5b1340cdf96c7aa6fd0
MD5 b96218e9eadfb4d96f08e95202aebc27
SHA1 f06cf8d059810e29b8841399c908085e88d4a2de
SHA512 6ef6088aa499d4db577a0598f10f3fa2f9cdf7cb59f4859cf785279a7615164d0b956c4d39a654db7c4851235ab55bf4c6a220986d613ddd5a979a04441c5f0b
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3bg:KIifqFu1//IifqFuyDA54GX79lSjurg
TLSH
T187154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 862KB
SHA256 9d3576278e337574df0ecfb90e20e3b4b68027afdfc68a2bc01d49c7479c91a2
MD5 4b65eae2d1095f8c9e20a1df94c4fa22
SHA1 80cdbc796dfc23f54f6820e7205b0e6a74873a96
SHA512 7f84db35f2f7c8760f9dddd51b47081ae1c27cca4d919103dc89067e342749d27f0e2d6c4df5f684993a79b1c8687567ff0e8cbf72eaaf4db1b35460d4a8ae58
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3GI:KIifqFu1//IifqFuyDA54GX79lSju2I
TLSH
T151154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 862KB
SHA256 b1995bbd54f9d2c10775cb2f81a5f3c4896967abd6956e27a9eca23a35492be6
MD5 5da07d09a86bc075d5df58b4e58ba859
SHA1 3d2a7ce253212e0476e91a000687832d23f1aaec
SHA512 8de403ace90b7cdb2d7aeff5806d7133c08ed428d27138f635d2a70aa7eac23a1caa8c22c17a423c9f094e7d82c5c6c90e63b5a0ef705756ec82090a003b494a
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf30o:KIifqFu1//IifqFuyDA54GX79lSjuko
TLSH
T180154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 862KB
SHA256 0ebac0a2e909c7477ed022413dd681a1b3fbc29141fdaa2ddf259dcb2c290589
MD5 1ecee0b5578be4cc457598f5673f3f65
SHA1 44d2ba1c0bcf98be2d7058651b84d867db3668b2
SHA512 b800bc431eb2d5bb6806f95b39f49a5104f8d0d4f4ffc8e7fce4ecfc2779e1a668975ee8e8dc8631d1419009dbecb966ab116af0d97409920685fc88bfe16036
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3X+:KIifqFu1//IifqFuyDA54GX79lSjuH+
TLSH
T193154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 862KB
SHA256 ace364dbf3dafe514203097786b3087019aacc720d6031d229ef339be086c3f3
MD5 24cfdc61ff91c4cf8d8942d820b3a3e8
SHA1 c7fbf13c5cb21792ea90515e4b745875ab2fb88c
SHA512 bfdfc3fb6fa4679d70c20c5ace0a2603f299b4f00a94be45209b59bc5afe690bbce945d826b9a8976df162dfcacb119f8db2a7054153779ff82f9ef51659b783
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3tQ:KIifqFu1//IifqFuyDA54GX79lSjudQ
TLSH
T19F154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 862KB
SHA256 e70fbf3a4fea2481a765cf505d6feedc2599afe01d6ba54619f107b635d8a2e4
MD5 4913c0fc413f4886d46156f0d89123c3
SHA1 f0d4f6965130e1d60cb96fbf1ef6d294bbde3d30
SHA512 5fc7b28d26309151da89680d9cb8b0b0c7fb0ee809a2bd416baaf7a4cc75b6628906ce4f79107e98fc63d99ad0808448b3aea5323f902c9d940b088faee9c371
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3iX:KIifqFu1//IifqFuyDA54GX79lSjuSX
TLSH
T144154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 862KB
SHA256 143220b95b03d8bfe670f10ba80d682935f0eb4551df0d61412c56cb65b2ead4
MD5 ae8cb70cd6df21c1953e80232a2e62fb
SHA1 8dcc2de1130206f659e5c2cf40d16019efc360d2
SHA512 b1b812084ac79f96e87267a388bfa0dfff8f0524b6e57e82e4453db1e5a22d0cc8ecbf3e39f79896a19ca6edf4768e5df5d4394c9ff8fca25563ebb0b2732eac
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3EL:KIifqFu1//IifqFuyDA54GX79lSjuUL
TLSH
T13C154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 862KB
SHA256 b73f771ad6965f8f1080bf12b43d4aa49f2e22d8bfe6da02bbb7ffcc5f4e8dad
MD5 e41e3a178edb3db040df388dfad4c5fe
SHA1 d71178644e510c3a099a7b8432f14126027f337f
SHA512 6b8634370ca00ce6c1ec60eea5e584ba84cf0f5b73cc2fa4add5a9b20e1908d9e78eaee3d066603f1e656837fa4646a1782a768ba83bc2594e94a700ceffea37
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3gFC:KIifqFu1//IifqFuyDA54GX79lSjuwM
TLSH
T108154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 862KB
SHA256 2d3828be1bb79100ce21bc375e419e7be52ad03683ccbb7dec2f90e5da69af78
MD5 2bbf857c9078dee573d484810c6ac9f7
SHA1 b382747781a3743df668f0d6ea3d08d065f1cdcd
SHA512 5792713ff2e29040a15332c8da1c5c0f6169e2c4f2cc48c631005b8be4136766a6007856613048b621dd39f8c59cea16e5856b51f2c16ed1e84122987d56a195
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSjHXsf3Bh:KIifqFu1//IifqFuyDA54GX79lSjuxh
TLSH
T1B8154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1812-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1812-1430-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2124-1485-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads