cbd3db825f59c84b097a4b5508b9d230fcbc9b343f2484f3311816b19dd1714c

Analysis

max time kernel
101s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 855KB
Sample260804-v4bqesed38
SHA256 cbd3db825f59c84b097a4b5508b9d230fcbc9b343f2484f3311816b19dd1714c
MD5 f2327a76996d491854b167abc8dee0db
SHA1 2c4184e968e9e700a3b2f8e29c316e628d7b21b9
SHA512 93a596ef9168dfdacd11fd58c4044da92f7d1c743b25a877ce7f0277f0014df951f6e4f605df0176989fa8a7d08fefe11b9439c977d90c8d82c867de137aa7a2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwK/:t/sCv7rTiw2RYwZCUsjwK/
TLSH
T182152A1767EC4894E4A7613449B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4920-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5d0-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4920-15-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3464-16-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-534.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-601.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-744.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-793.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-842.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-855.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-880.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1008.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1051.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1082.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1131.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1150.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1323.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1343.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5d0-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-224.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-534.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-601.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-626.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-723.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-744.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-793.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-842.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-855.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-880.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-919.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-932.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1008.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1051.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1082.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1131.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1150.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1175.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1182.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1219.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1323.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1343.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1368.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1375.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1388.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3464	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4920	2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe
3464	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_f2327a76996d491854b167abc8dee0db_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4920

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 855KB
SHA256 cbd3db825f59c84b097a4b5508b9d230fcbc9b343f2484f3311816b19dd1714c
MD5 f2327a76996d491854b167abc8dee0db
SHA1 2c4184e968e9e700a3b2f8e29c316e628d7b21b9
SHA512 93a596ef9168dfdacd11fd58c4044da92f7d1c743b25a877ce7f0277f0014df951f6e4f605df0176989fa8a7d08fefe11b9439c977d90c8d82c867de137aa7a2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwK/:t/sCv7rTiw2RYwZCUsjwK/
TLSH
T182152A1767EC4894E4A7613449B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 eca0dc3ce8713dfdace27be58ae8a3e62edd4920dd8ade3982710fbddaa33a83
MD5 ec8e9df931dcc57bdf903063171c0585
SHA1 da2c9ecfd7bf63d6d534e83654695f2118d99b46
SHA512 2f4bafb496e9f80918ca92fc66e59da369c7ff29f914364c7e1c0517ca8f7f8ee7829478e69412d289c89015825203d0ca20beab46b1589f0241c386bffeefb8
SSDEEP 24576:t/sCv7rTiw2RYwZCUsjwK00Le5ji0hmxNrM:x7iw2TDPji0Aj
TLSH
T123654917B6A84661D073E074C5E6964AEA72B4461B30C7CF12A8C73C2E63BF1AD39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 869KB
SHA256 d49a3c2dde6dc21596feed258d1b347dc43f16fb50e22fa09d4a19b488f78b34
MD5 3d1986fd5222ffdbd106d39640118800
SHA1 1e094e59a621c4bc4483da81d8627913624b5627
SHA512 ebd4f981d473e9dff8b1ba1f46e6174a7575090ea18457cf24ce6dafb73cb3bb6552c3967623cbdb976a80e56955699147d69623d9d057cbe236858e5ed84511
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwK+a:t/sCv7rTiw2RYwZCUsjwK+a
TLSH
T1B4152A1767EC4895E4A6613449B58616EB72F8561B30C3CF12788B2D1E73BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 878KB
SHA256 fd16c984e42f41a8e58a44a1b4ba30778e0052a92348e2e2526fd55742d87fa7
MD5 9412b692abde72112264584c362df333
SHA1 4860fec5772a9bb9a1937ce2cad38980e64a65fd
SHA512 db5b083660a776f61c8215ec420e5380d6f34929386504c03c7cb46a0e74aa476cace0ce69b72d1aaf5fc9cb3fa8932f41e077737ae29898a8d91160fed60319
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwK/6:t/sCv7rTiw2RYwZCUsjwK/6
TLSH
T10E152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 878KB
SHA256 3213c7cdff3c362ac9ec8c9c28f854a777a7f00465a385e77e3c19d3c70860e8
MD5 e89a20d1684241c82098d9041a07578b
SHA1 a9bcb0991201c1d58ce8bfe6c95ca0a3b010ccbb
SHA512 7eef2112354b8bd801e027a051a0604e877c8f74d1f6782e9ce98c37c2914b41f6e89b545c7980b7c92d7a20aeb86c81e698c6735e75b7459531443b412b52f6
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKhN:t/sCv7rTiw2RYwZCUsjwKhN
TLSH
T17F152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 878KB
SHA256 4c4864dd8c862ba8726504a28e6444f431cbc7e42a30eecbd011388e14d471d4
MD5 9fc7def9921b0efe650e208e39e536b9
SHA1 afef066e4cbbfee231a039b1a0a66ce300071d8c
SHA512 51ae1fae571fae74478af819249ddc523a840a680cbb2e8bc0a8f366e069d0b70e162f1b191901cd989cfea5fb5f28bc7885d1ffc42dfaaaa97c1e616a6d68f4
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKXf:t/sCv7rTiw2RYwZCUsjwKXf
TLSH
T1E6152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 878KB
SHA256 7f13f8e46120765ef9f2896fedfa933b98ce134ae045639f1848c975ac408ef6
MD5 66ccfe4ee8034d72c39eef41daafd801
SHA1 16844c3a0b64516de7f2cc4f8a46784e7c54fe8c
SHA512 0bac9887d49314b96c90292f0bd77c65a7e842a6d860ce9c975f9caac1e6a826538bfe626da4a0336dc40c21624f768e158bfb4eb80139dbc4b46bfa7adafba3
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKZo:t/sCv7rTiw2RYwZCUsjwKZo
TLSH
T11B152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 878KB
SHA256 48c5f9076c014d28201cecce3487fdcfe9327646bd1224de6cea70f6cfed91cd
MD5 594c5005247dbdd4f5e6bceaab52904c
SHA1 bbd3e1037f36aa564f2b11ae39d03b52c9d045e5
SHA512 3194fcc49b72d3122b937c2a5f903236a4d515632aade1b6dcf3a4cea436bc3fbfc55eaec5d78d11a14081cb5a6b013148d5cb28fbd3da3877b8af1b2e3ae4c9
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKJu:t/sCv7rTiw2RYwZCUsjwKJu
TLSH
T132152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 878KB
SHA256 c73ad7d47064f26538516c40f72f0b3c957277915f856d69f16baa1d0754317b
MD5 dcfb4b62497f1710926db3329f8d4e2b
SHA1 20f3a2fec7f09a88b390f75d4a71e02760e94b20
SHA512 52196ef2eccfe39ae2568d2ccfaed0eb88b282317959bbd39f0cb4fea22255cf9ccc56e030290d22674e335aabfa276445e5c912e19d57cdc2a6b1710a9931de
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKv9:t/sCv7rTiw2RYwZCUsjwKv9
TLSH
T1C0152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 878KB
SHA256 d53c00b54748e595de63151bf410be422e9bb76ddc3721ee9c789bdb741bcdaa
MD5 b94bc41f4658e04c52469e6c7ccff03e
SHA1 b90699c7be4b08870fd8fad533c7e64eac82b8d0
SHA512 2e0755ea3ac35b77a423a3f5c89f9be9c9aba334a91fd8471d1a1380c5d363bc55c8119702281fa95f734c84ac55d49c7f6c50bbfd2c43554c411e2ed2be1728
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKLc:t/sCv7rTiw2RYwZCUsjwKLc
TLSH
T174152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 878KB
SHA256 d55732bebc9ce478d7b3d5b5d1f379670ea68fdaef2e087a670459a8a86e8340
MD5 c577d2a0b02db7077da719e5a457903b
SHA1 fdbd450d9e29c993123d3a3409337b60af1a9323
SHA512 2a32dc1d719b05746f5384eb3d5d53320fdfa22a023b6dcf94147bd9c2f7feeb851c0f1ca27f0d0472600a488bd580f113d5f71a58a6bf0ec1d02cd66907be4e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwK0p:t/sCv7rTiw2RYwZCUsjwK0p
TLSH
T12D152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 878KB
SHA256 467920dd6094ad93407561611849b07d5acb91f4f789a000db7b0078a910ef47
MD5 6eebe73a945197c7ad090b292cc9f10c
SHA1 4a418a8662bc54d0b79b8175b09d6a882cca9b7e
SHA512 13561024f8abbb2de67d526d639afffff5481a9cb972aa08f19a1035b5416be6039926349fedbeeb78c7019c790b2783e64339c2fd8160a4081b66a34a28bb80
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwK70a:t/sCv7rTiw2RYwZCUsjwK7N
TLSH
T11C152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 878KB
SHA256 fe050d8d36001210aa4c1f398ef60afa7c5b738ec635958d65a19529f9a1749e
MD5 e83989191826d51cf12bc73125c7b80b
SHA1 b4fcf7d6d2df811c29462e6218743a808097fa9e
SHA512 c28d6b82ab65be1490862d7937779e6a2c67a424e093f10fb913f1e948018b289d9ab94473e02eb930366345f504d46ceef152ff08a96969610c6af15b708f82
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKJF:t/sCv7rTiw2RYwZCUsjwKJF
TLSH
T19B152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 878KB
SHA256 48cfaa7fd1e4f2a0c0630a39433fd8453023650b2c92a25977dac7f7d0d65edc
MD5 08853dc6e7065e4ff094b44f9e2d5389
SHA1 308e3e0031484fd98e3c81b76cfa085e101a59bc
SHA512 e217eb08dfcd2a1c09023188f00356fca0e97185b3c86c35ba2fc2f4552e1273fa64e2ef09c89217baca38c6911e322084c9d549308f6a534938592ce263c6bf
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKiC:t/sCv7rTiw2RYwZCUsjwKiC
TLSH
T112152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 878KB
SHA256 fb351afaec883100f1211596e20a7fbaec8c17d4a6129848538da73da0d2a86e
MD5 b5d2de95e881aa39803ee341dacb21f2
SHA1 bb04eb018df48df2b7abacd906a0abff705bc06a
SHA512 4eb7fbe549fa2cce6a6bf5a4b9b493f02878d70e2bb515baac1b7336bcf8dd0b986895140cd0caa167e2c246cf0a3897075189a2f5fe5171bcb51b4116327532
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwK9w:t/sCv7rTiw2RYwZCUsjwK9w
TLSH
T17C152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 878KB
SHA256 450034c652c3ea4c3d4470280f4ff6f3dd82c333c2b58a7ad9958e3d74394423
MD5 d3e249bd6a2629533b364029927a63a1
SHA1 60d7b1da8a108a54e2fdd2150ca79bc262f0cd11
SHA512 351acd38e81729edd3d98ef282c2caf4d5705ef3053924c381aa2ab342d4ec54883834b663f0a92d5e7d1e0dc64da0536a44429fbf2f5250d7c885cf79bd1bf9
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKsT:t/sCv7rTiw2RYwZCUsjwKsT
TLSH
T107152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 878KB
SHA256 e3c17d6610dc13c988818720c7ace3d97fa40cbc54538516d2fd217aa09ef551
MD5 ee0b55c01aa71c349faa052c442a336f
SHA1 a388da2490ea5d7d5334b6cdac3faff9f72f5e82
SHA512 9ba9cf6bef1a7c0257ae77be58e441b466230373d4992922fc136b8456b3b649dc750def2cc5a795773ded92c67cae30bee694b267909918e61d907f6640463c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKAu:t/sCv7rTiw2RYwZCUsjwKAu
TLSH
T153152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 878KB
SHA256 046e0c82bd36c8b248843254daeb1333d3353af62c4aff21cf33084b42a8e690
MD5 68fdf89cfb59dde0923c48611f72520b
SHA1 eec11722901bdb55d645abb56d8c9e6c6e8b3c71
SHA512 e6e1dc206692acc7dd4cdf08fc5838b0e763c471d1d4fc40b54be92cfbf8746591d7a6acde54f5d22b2901370d07984ddd25a189e1a03f47ec5e244d606ff0d5
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKeb:t/sCv7rTiw2RYwZCUsjwKeb
TLSH
T1FA152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 878KB
SHA256 05747a682cdbc9e704e449a2a3aebcb72e31e392d0968e45fcb6b27ba30adab7
MD5 0eda8604e3fc71905b3813b108926c84
SHA1 ddca18232791d523ceebfb63259b01baf96fa58b
SHA512 c4174fa7024d78e5c3af97d00647d3b013b6f9db15c6e1108cb4918a33a82ce361edf8ce9dfb6ca19de63cd7abe8aea80b90062bb6250df39a9a40baabafd8c0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKIf:t/sCv7rTiw2RYwZCUsjwKIf
TLSH
T120152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 878KB
SHA256 f46ccea509c87d59bc9f106b75b61b3141a2adbe2f916d839c033c67fb95cc4f
MD5 c6725565e51757f20b6cee566f0dba12
SHA1 c71134062dba7690e592117865ae50d31ad5e319
SHA512 adeee50d957fd0650aa933e271a5d24f522b93d3a285997bf72c79ab3a0e69927390daf9ad7c3d45e37ce79b9d7290f496d8932bfff1dd02345925b1ba0f59d2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKlK:t/sCv7rTiw2RYwZCUsjwKlK
TLSH
T1DF152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 878KB
SHA256 7b0f22ffe944274fce203c91f31ca95f6ae739b210fc065c7577997fb7dd56b1
MD5 47a88b9d6b5a590ffb41025a2f2547e6
SHA1 2951c9c36df5e8d39582dc663e1aecd869cb7518
SHA512 812aa14b2719edc6b265a74fa9357b7852d0d3c3f84507c2f8990fb4411242cd5f2b9332fa2e556fce5c0259dd027d244de9eeb478a05bf11ee0e94e32df4054
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKmk:t/sCv7rTiw2RYwZCUsjwKmk
TLSH
T1B4152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 878KB
SHA256 a57af7f9057a1f1b2035410662f3630dd8400ba760ebb6ae8ed92e25979c362d
MD5 31c0d70228867815d563ee53059c7144
SHA1 f392bc7518053232f0bcee119501794548f671a5
SHA512 9b79d9473019c3a20d2019dd7dc36322a4a472582368206ff707909cccf094ab0aa232c5a01484566351931214ce03f68939cc2bb609754b8ba7f900163dfc42
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKj0:t/sCv7rTiw2RYwZCUsjwKj0
TLSH
T1B7152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 878KB
SHA256 29e9b1882de8a2b655e27556f780f4de395fefac2fb499f9e56aafec7a1367a2
MD5 1a7c6459154c0562f8fd4291632fe892
SHA1 9b3ee96a0566bd25f747695cdd61148f5d3c5230
SHA512 0e72367daf971eb3fef7acd046559d7ded2d822a29a26dc8a7a9106cca15bf7a4c511160920c43917c612fb7bff5f57e5268ca99cab67fee3a75609f0989f28c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKy70:t/sCv7rTiw2RYwZCUsjwKyg
TLSH
T19C152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 878KB
SHA256 18b8c9c07bfe03bbe50dcac18428b496a2d4fc40cdbb557de8b9044fc5a93a58
MD5 b069c8f160a9138c620f83ea75eacd71
SHA1 267bbcf924e86b56ad2562d4b37763b1fcb932e7
SHA512 1c41a1ed2dc316c5ec59e120fa0e3ee1792b3b7642700a71948d966623b11c39f156d6f1466f5aca42cf402495769c377855635465a0183fd4325aeb2231c153
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKTr:t/sCv7rTiw2RYwZCUsjwKTr
TLSH
T1A7152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 878KB
SHA256 b89e91c11a30d9d048f9ba25770f4f4c66a181039453298b174340d3f1f7689f
MD5 ef01b96d34cc04477240bc12050499a1
SHA1 7edf022dd83eff67041e8762b92fb289141f8039
SHA512 fe5c3406b68f036321dc76c5aa3b1962411d7aff14c8a510ee9b7db186c29b154c8ceb5b9460e337d93fabc42b3964f75188098231358cd06393a1247be6f598
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwK1n:t/sCv7rTiw2RYwZCUsjwK1n
TLSH
T1B2152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 878KB
SHA256 2999232ef560ef7a8566b203521245eb99ff745ef8ba84989608fb70b24bc90b
MD5 7cf83ad053967446c9b93c3c537b27fe
SHA1 32165c23914f91c6c29dd796078c961725a2bcb4
SHA512 c2e0005f99b1c914138b6b6e80096757199fb84178dbc81faee14f2684b2afa0d5a3f6627df5136fe374dad2709166b5397d594721e75e92aa5e8c6434041713
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKBx:t/sCv7rTiw2RYwZCUsjwKBx
TLSH
T161152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 878KB
SHA256 b019dd2b2ce349f339427238a41bebb67df8a225c19a5a2b6b710d3eee13e407
MD5 0cb577ece2a746896de17e8e6f1a3301
SHA1 476f4b89898a46fec59c7b8b1d96eccbc382c811
SHA512 88a6447746774832e121f0bfad16a9d1a7f2e7fb384d6b13db3d3181dbf3c90be1d008658b8257e6a0c7528f1c1bd54a046df1ff39e2b1426993186db93a2ad0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKvA:t/sCv7rTiw2RYwZCUsjwKvA
TLSH
T1CF152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 878KB
SHA256 80f25df48d6483a70d688d9c9698c7a51336532d554e92c5a8062b39a7fc4009
MD5 a647a884e24591d1f899afe40ed63caa
SHA1 8724bd127194ecd435ff295089397fe49732eec7
SHA512 3c464a9d20be67fcf8e92612186129c6793b72904e5a2fadeaf0f25b312bc011556440c011cad992e61eeec5ce7e0924d94d47a31d8e68e787c4d6065f4d0546
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKg9Q:t/sCv7rTiw2RYwZCUsjwKg9Q
TLSH
T1D1152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 878KB
SHA256 b178929f702bc8b582a335bde38f2a445100240a8586d249772c9d23a6eb9feb
MD5 9ca18b62512c0fce1894335110be7c58
SHA1 08335b8041db31c15e9b860b5bac55b0fe4fd295
SHA512 7d28c4dfd84d4dbf0d2b449083dbe986fbdc4bf17794666e0392ff429a4830a0b29e89052381bf4c665e476aa86589437f5257f895cd4993d95111684145770d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKh4:t/sCv7rTiw2RYwZCUsjwKh4
TLSH
T145152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 878KB
SHA256 94a3c4ab7a3211870c6a48631e1a1b176a5e8c6f0390f8cf3dba4bc8cb168b12
MD5 6404b835ad3393390d166bb2d6ba48d4
SHA1 afa3dd73c12c31956eb0859d73fa7f17eb6e032c
SHA512 0f50220e8c722c4cc76ce7eecd897187bd2e14de9720ca5981aa4b72356743b1df26aa817b02a84c7456dd43bb63dc02ced8d18ee3c08e7eec7a7c3914dc7b09
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKEu:t/sCv7rTiw2RYwZCUsjwKEu
TLSH
T13C152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 878KB
SHA256 b2fac8c83baec52bb93a753acd5866dae6a9b531e0bf6ed06da51697f9304898
MD5 c9bcee3364de0623e0fb8e504cc91e46
SHA1 b50bd2aedb86965d6c6877a1b24c0239122ae48c
SHA512 719f4c68dece678cc61b5d317869dd205887cb5aac179143c958e5cde126d55cf42d0aa05989ca6a9771ae8ca126f95d07e1f4dd86913fd72222f3daf8dc51ea
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwK1j:t/sCv7rTiw2RYwZCUsjwK1j
TLSH
T1BD152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 878KB
SHA256 24fcbe37c7d24fff3ad84c2eb18b32693c6a537bdb6e195a2f9423339c75a1ca
MD5 74a3805ffcd55461a2def2448c9ee59c
SHA1 4a8a9651b82d822aac4f29cd4158507776228ebd
SHA512 229a21dd3b6655491298e46d62703297ecea2a8db9a3ec5a15a774716d43a4cd3cbc855141e99c98bbcbb3313b09d6387ab630acb815eab60584991d15b7db20
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKcg:t/sCv7rTiw2RYwZCUsjwKcg
TLSH
T1AC152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 878KB
SHA256 11e8c6d7bd02171eb2ac797421dcec6f65994b88e2b6b7ea6b88215a30118257
MD5 c71864851c4b282f1c88c15f6e3d583d
SHA1 adf956abaf94e44ce8330338eb77e19600cbe931
SHA512 f1662ab84ce533dad840981e3801c50476feb6442f2009fc383dc8928326e4a208a825c970e6e43e56bec9d65cd76218786b83881117e1de5cead845e53de092
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKDI:t/sCv7rTiw2RYwZCUsjwKDI
TLSH
T1BF152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 878KB
SHA256 0f2c181108dcd7c7a8d55aa4b943c679fa0fc38f00fd04b05b8644034237169e
MD5 331f8d4f83f08335dc92d8a17a7f3e86
SHA1 f0a55919632b75e85aef650494a06702f70609dc
SHA512 93652bdbc33f310395431726bc1d0dbaf36d3555d3dac56088a91d952067f9a5656a2e7657c04a9689969f99e803c329fe470172e032b7917e9ea2bbe7d21fbe
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKZo:t/sCv7rTiw2RYwZCUsjwKZo
TLSH
T168152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 878KB
SHA256 6a2ddf32943d0c3001a23f613aa26ca06cfff071ad051d841ad1dd09ef7cd1d6
MD5 b1144bf0549a6552dc6c398c2f204ad8
SHA1 27a23da6b8a094e46dfac872b9f0a063f7e31c71
SHA512 7cec09702b039aa8364620ede0856f22d0928bd2f750a6895e12a3d7922979e76f9374ddd7a15605c8f37af25c0b17983296ad96718f3a7b7b286b6b4ed2a803
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKK+:t/sCv7rTiw2RYwZCUsjwKK+
TLSH
T15A152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 878KB
SHA256 fd2e7911698ce5394a0048b5175b0d0f825b4e459b1ec1f64f210d727974baf2
MD5 5ef92221e09ef07e6a5e740de57e07c7
SHA1 ee39f77dfb2b792aa519f70173c5e52c3be9596b
SHA512 42f5586d2a68773080443d5b28389b6ae0955f9b1507331b76c940bf9fcb1c2b5e789fac86a407e5889d594f6720b9ea46e3c1286386c5fa5d12ac36978ad209
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKKQ:t/sCv7rTiw2RYwZCUsjwKKQ
TLSH
T182152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 878KB
SHA256 e4977ab8071551e6025d1e6b760be70000fcca0b9b3e2f8584bea86a26a9d338
MD5 a5095d13bd877b43e231b61f03dd8481
SHA1 a94c488349ed00d461bdcc53b3532722e8c1206d
SHA512 6ea18225a2ed8b7e3b6df48be1b1cd2133deb136c2d24cb2cfb4e6f6aae274cb847cc6ba73198f5c9e3c14a28a5785368bc8a7f53db67ff79a8846727d390beb
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKbX:t/sCv7rTiw2RYwZCUsjwKbX
TLSH
T12B152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 878KB
SHA256 9c97f2d0d225fe58f60d937280edb852f860172e7e260dd35bce318ae5c8ec3f
MD5 bdeb22e7040f51c65fbe681e20f080aa
SHA1 b2904929c4bda530ca58b0b6d5e9df7b62f09d78
SHA512 a207826a1925e24166e73b390e85630d3761b3de1817125b2f1ab78d1f64562aeb2ccec3211f808994ccd138c89ec20998724eef3a00a304d23f5680bb943f24
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKJL:t/sCv7rTiw2RYwZCUsjwKJL
TLSH
T15C152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 878KB
SHA256 b097e1c7df1d9fc4482f2b06eaead68d20bdec831966da3c8ea00ab57ebcdd8b
MD5 e0cfab14ea8837ae542b3206c553d58c
SHA1 5cf5c084fb27b5c168b5b3f08868d1199736487d
SHA512 19e477cda389b8779d799ec3df9638ecba6473e6a21d525c5f25048f640baef3c379a20084d323d4e4fa950376c265faa34713b243740960efe78f667c940c2e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwK3FC:t/sCv7rTiw2RYwZCUsjwK3M
TLSH
T128152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 878KB
SHA256 b1ec2c6fb530ee75e47187abeeb361e53149745b0fcb8b994a35ff4abcdb368f
MD5 22f792f2c52a0abd7dc0bcf737a9308b
SHA1 986de0c77e5964864617d783ef315991e2e189d0
SHA512 ce8bd407e5a630142b455dcb366265e258aa6585efb6ef5d65f5d52bb9e1f545bfda5795c4283805e2f9dcfeea8003374f5c8bef3e44948c995297888c4696ef
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwKAh:t/sCv7rTiw2RYwZCUsjwKAh
TLSH
T15E152A1767EC4895E467613089B58616EB72F8561B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3464-16-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4920-15-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4920-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads