dfbab9519f5ee66a9ed155e8818faa12b269dc69cb2c17d234fd2baa6eff5267

Analysis

max time kernel
111s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 18:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 886KB
Sample260804-xbxtasxfla
SHA256 dfbab9519f5ee66a9ed155e8818faa12b269dc69cb2c17d234fd2baa6eff5267
MD5 b3428732c7ef28b9c3b45054af04c70d
SHA1 c16e8e291fa83d9aa91e15e6b8b4d90d7761de5f
SHA512 124205c13cf6bb594d3d434714c26165c02b7b13ba7b3cc8e93c469af530fdbdeec870aafd9ff3e9810c9113a7bb80c3346867c71d93e27c0475cfecd9676524
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSsCjHXsf3z:KIifqFu1//IifqFuyDA54GX79lSsCjuD
TLSH
T186154C06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/4456-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c536-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000008f19-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c72-58.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018965-197.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001897e-252.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a42-307.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982f-464.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-580.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3f-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-660.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-727.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-764.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-795.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-838.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-863.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-882.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-889.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-902.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-927.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-946.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-995.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1038.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1075.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-1118.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1143.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1168.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1212.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1315.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1334.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1359.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4456-1430-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6328-1431-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
6328	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4456	2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
6328	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4456

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 886KB
SHA256 dfbab9519f5ee66a9ed155e8818faa12b269dc69cb2c17d234fd2baa6eff5267
MD5 b3428732c7ef28b9c3b45054af04c70d
SHA1 c16e8e291fa83d9aa91e15e6b8b4d90d7761de5f
SHA512 124205c13cf6bb594d3d434714c26165c02b7b13ba7b3cc8e93c469af530fdbdeec870aafd9ff3e9810c9113a7bb80c3346867c71d93e27c0475cfecd9676524
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSsCjHXsf3z:KIifqFu1//IifqFuyDA54GX79lSsCjuD
TLSH
T186154C06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 40310d876a94fc5681b1c02d9e8f22cf831f3c675f9e4c40a4444efb942be35b
MD5 3e5861cde770d4c87655f50439f99b73
SHA1 6ae4d8c277b30a900672c4e3b994aa030eb656ab
SHA512 3e384075f676414b6fd508d68a0904da4f1f4282caf9f673cbbb7d748f5357e3a9263a3bf4bb9b86fb32b855e88e5ddab27c09517298f093c463064cc021cdb4
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCju/0Le5ji0hmxNrM:WqFgqFUH1Pji0Aj
TLSH
T119654A16F6A44268C02FC075C7D29266FA73785117F096DB13D4E63C2F22B919AFA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 900KB
SHA256 674f67038ba76abb01b4b3e235c03a6de2606576dae346c75dfc7179a2d6c96a
MD5 29344d99c49a86a3a3c1f338f65052f2
SHA1 e5b39ae54114f78866115790a31d811621a88660
SHA512 7c109acfe516650734f705a19e1c983399b278d61155088c5d548d38daa47b7a2766f8ca2a9deb696df34af648306820c1452b7bcd8e93d1c54668b3e7a53749
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuha:WqFgqFUH
TLSH
T1CE154B06E29104ACC55F8130C7A65372BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 933KB
SHA256 5dc9a27918348b92badfc117e3e08f010d8a3078e5705448d3dd857ab4c8b3f4
MD5 e08181556c1be0d704b8def6b79d3315
SHA1 7dba7266877acf89322f2f5288627b198af8f37c
SHA512 84bde98bfec9cf8f8c776d07b452f0c7df5a473919f63604d8cd51eff44f1892b3445cd82711ec241ce466796ba117fd9edc274f108202a13661bfc3b7af8c6d
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuib:WqFgqFUHUb
TLSH
T1A6154B06E2A104A8C55F8130C7A69372BA73BC1156E097AF13D4F63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 909KB
SHA256 5a8c16197a21942fca35382af2424e6689dda4f301a63ee73fa5da4588a4c09a
MD5 6fab3633436735cfbca6c7972bd9c6dd
SHA1 bc30f6779b3ae02332d21932735312301b1944e7
SHA512 8d5dcc1fefc85358e7f836ae9c285523da55e5512dcfc259788a2ce53e86d3b16aed57d8916ea41b96465149c6735a527f54a6b0be28338ffc27db544f0ebeef
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuZZ:WqFgqFUHZ
TLSH
T113155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 909KB
SHA256 be4d67b75e8290e675dbd917b852f836ae8f25e362c9f2fa92407b5d168b498a
MD5 29185d78d14e159a2f4746015e7140f4
SHA1 8c0c922597119b00cbae972cddee212ee02d5d93
SHA512 ce3e62506c5c462d9a5e9fc7bde82c4e165b2738f3a01d2791353c0863f5ce7a327861929ce89b167bf2d2dde59591e5181078537f25ad0afba409994a2b358b
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuy1:WqFgqFUHm
TLSH
T127155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 909KB
SHA256 ddd734df269bda527dce8b4c6cca38a3d77c03346a232eb5520467ebd0dd1017
MD5 8b5f0ff7f53487894fdf7938ecd81449
SHA1 9f8fe485530300f2c029e23fac0d4d5261488afe
SHA512 6511d70d6c8067333cfeae7bdb208be8654c466f9bebdd26ac359b08b9628ddc22903e48f373bee854f88d9251aadc50655f270ea7c54a203e8e41516b694b7f
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuY6:WqFgqFUHx
TLSH
T135155C06E2A204ACC51F8170C7A65371BA73BC2156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 909KB
SHA256 b8d623000871ffdf7b4bd50d04a50443af620aef92caba8e961b70fb946930ce
MD5 f9011f8d8cce3247eaa04ccdc0ca955e
SHA1 457e9075cc727180c31339650781fe8b6c6a0808
SHA512 ba781bc153ccffe2b7a82e246bdcec51cd7b27cf5939696b8bf162e834d8853d6a7e97257aef2f2d3d7a30fbfab5dbaa7165da6ed03f0c81c4c9de140a3d8287
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCju8N:WqFgqFUHI
TLSH
T1C0155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 909KB
SHA256 ee6f181c9518c91ecf639fba6d216f7e1dc8490241407fcaab55d968967c7220
MD5 bdd295679497a0dfd3d70b61012f0e1c
SHA1 3a20da9dca1f6e819308f040ea5e5407917b5dbe
SHA512 850b8aa99cf316b06cf79790dd0f4ced114153f21c3394d68d47f9f6d9f465c22fe551956fe19e220caec753cd00a8700085c25292935c0200f6bae4aae7f3e8
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuyf:WqFgqFUHg
TLSH
T1A7155C06E2A204ACC51F8170C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 909KB
SHA256 0d3ea010efdd7f2b64086dcb06db24b4fb9725d96b1ed7fae4bc4692c70d4e69
MD5 18d81297535e8389eddd8e34dc2cf9e5
SHA1 0e22ada8a3334c613f3fcbec284583c80d88b218
SHA512 65239b0fef9f4bec4af42abe9b9bc0a94d36a96d443d42f78273925c2a31fc7faffdd887d20c6512048113c0e45a97281ae435029a60640c667b55705c5eaaf9
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuMo:WqFgqFUHt
TLSH
T1D3155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 909KB
SHA256 10b194ad28cdc9a5760a87ec5e32644d780cb24cabb63959b2014d971cfe31b7
MD5 9170015d5c31f592feca4f55772c4c3f
SHA1 9284c4e9c2381ca0bac0dff16e71c8635d28de3a
SHA512 4278eb02e476aec8af06d25c141c0fd04f16bbefcfec3306a2e232e0eea80f708eb7d6df2d03d402a16c117ec0c145c6f27a02be9cf3800e2e30363893502aa1
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjusu:WqFgqFUHf
TLSH
T1BD155C06E6A204ACC51F8130C7A65371BA73BC2156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 909KB
SHA256 822f94282982515d961a1a0b3d52df1d7d35fff291fc81fb1b850fc60632a602
MD5 025430ff0f51acaa311d389083f60559
SHA1 c9b076c0759b2a23433ea865a23b2c17423235e5
SHA512 e0752f49f968dba1d65bdb69613fdb748e4670ef8292704d7f541a507037abae37510cf122eca6b228cab1020560c47b7df984911a86d3ea1c24e58cd9a12287
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuw9:WqFgqFUHe
TLSH
T1A5155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 909KB
SHA256 32e561d8ce10b67d6f438e95b2d55776ebcac5f1d768a79f1f48f5ec1ae169c3
MD5 4e5af4a4569da8802a699a862f9b289b
SHA1 39343af00752b81f2e7f200e4efd20b26f40babd
SHA512 97dcdbca180f79c3cc42745a1ce1667f4eb3a61d50a2759fef8260b998973ada1c3f7b3ce1f2a29a9e5953f455b4c9ed7c6af8418d76277a6a9bc03a87265eba
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCju4c:WqFgqFUHz
TLSH
T15F155C06E2A104ACC51F8170C7A65372BA73BC2156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 909KB
SHA256 4a941c027eb4fd64a952c068cdff6cf5087334e9b8d72ab6beb7a27cd9a3cf30
MD5 0b1ad0b08ef3de7a5aa634434f1b5f70
SHA1 de10ad366fa19c91bd65b6354e4e94073fb5fcd7
SHA512 d0b7fff73d42a77b02116fee4584e6faf20db441b06eca897a39b2e0512967731db6f5c9bf1fa9be8a4570c439caa585b6f52441baacd1066572e0ea1c3a8631
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuRp:WqFgqFUHR
TLSH
T19D155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 909KB
SHA256 01151ad2896326321b0045b23597d7ce7c3c3a4730fc5576b56e34533e6db89a
MD5 5ed8a6c621127f994e5c8e932f68ad1c
SHA1 f8113e77919bfcb4aa2d4893912b36869f0c0cc7
SHA512 4e23b9c9584378bd2ee0ee924f6a636ac974411a977bcc92d91655ae0a628c6f31e4532781ea3214699b63d0a107482fd121e024c53df4192af774754fec5d10
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjumN:WqFgqFUHK
TLSH
T157155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 909KB
SHA256 831f398b33fe8563392941bb5fc08cf59cebccf9b6c5df1a21d18789eb2cd8b0
MD5 65add41ab1abbcf22a08cf29d9e3ec96
SHA1 0127ec06f213644e77a5a624ee81c5ba03ab43bc
SHA512 a9b08c3187d4069adc2ee2a47c658d37d4e17b88a0cc74d755e285c2698ff883bc9281aa53eb0470d958a2ba12148a4ed8e4d9d0ea28a13cc68372e47f67a6a7
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuqF:WqFgqFUHQ
TLSH
T142155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 909KB
SHA256 8d46585c926ae314974766082b1d56ee39efe6d75f211be13f2cca5420ab8d27
MD5 99ccd292d6f502693ec731aa20193c2f
SHA1 cc23a89d5db20ed674dd752b7e0dffce765b1010
SHA512 6486b30dbafd05dac074d3271cee15dcab68d3c39fe6e9930db0acbc5b68eb23414fe7ce9ce2c09d2cc4fb3d8f8f56e884bba51bda4982308501b4f3c980e5d3
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCju/C:WqFgqFUHk
TLSH
T1F2155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 909KB
SHA256 367cf2881f232e5b20eb3f433f4e4ad165c6e819c45f39fb39736d527faac47d
MD5 9805cc2ccd108824cb4ea946a207c643
SHA1 9a29b60acb0b7c39b72a930bbccd255e80f5fbdb
SHA512 22cb19d09a10b71e29c0c7f2ab41317aee73ffea963fd1117d710e264012cacb79e82c10ad07c483bccb97a62fb934e7538fb1a5cd1109dfc41865c7b0a8ec3a
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuAw:WqFgqFUH5
TLSH
T1DF155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 909KB
SHA256 f7dfcb6e88f24d0ac56f327c151bad4158391101bdae68e2e5578fb0f7343e74
MD5 ddc86c4861a9a3c98d297357723a4077
SHA1 4735a1c646683847b191c47e41c968fa7ddb423d
SHA512 d6f44eac2d2f93a9d36dc7a19cf36ce8ffffcb9c56d897ab0fd20ecfab36129f132a9b97ff3583e00a2499f1f380df45cce95d9e62c81915f301a8923b1c3398
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjufT:WqFgqFUHt
TLSH
T1D6155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 909KB
SHA256 7635a8e7d3a95d9d2220466f5ddd51d720875c3d7fa1f320c147f4a8453c6b59
MD5 c22c7685a947a97499e9b81233f9d055
SHA1 541a60ab439e5c9eba644cba1eb0927e2bdb6948
SHA512 b2d95a1c98bc0bb33fe3874bd55041410fa166727aabcbff0709685ec334dea6766d9619094b23a0ee07ee0e2290261af2760235375d2d130de9a1af8ed23b48
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuZu:WqFgqFUHy
TLSH
T1E5155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 909KB
SHA256 2b3ef7a64d3ec46c75e2b0070c688c3730b74eed01e516f752c968770c45f4e9
MD5 f6664a378153fe3dd80eeba32205c463
SHA1 b2aa502e68a18b690b53158c8284384f41fa279e
SHA512 8900dcc113ccb425e5894fd278a686398a2c01ab9ca224cb4b0a79b8e8220a8207bead51875ea15aa74fdd487b55b1a9c90c494f9a0209d41c1bba63228831e2
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuRb:WqFgqFUHj
TLSH
T122155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 909KB
SHA256 c1b54df1a18acf619969074159ae68bff13ff456b91cc3c65e5e91e67b8e9e6c
MD5 18a6556f23d09ab3b5f60e35d22270ae
SHA1 567075286a02119a336b21574779f712f32651b4
SHA512 7f0cf15c2f5efdd53481c653545e002cf6377721f229aff68baaba2862f90125414b0db4f700a6571a0710a86a89e6062c87503e3e2f341770f0acda37da51d4
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuZf:WqFgqFUHb
TLSH
T16F155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 909KB
SHA256 81ffaf863b55e4434bd2c62f85b25a3ffcdb9ea7ea09a3168027341949608170
MD5 bb5b00db199d095660159b5592ff45fc
SHA1 2e69df964c4772db24a1201cdaedfca5a9afa4ee
SHA512 e6b6341ffa2fd0f794409b5697e0b423fe71548bcdfb7894f8dd3a0d8ac4b636c077e7b0894d6df14d545dae9582c58f9de48e33cb59521f0a8e54c3124e6703
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuiK:WqFgqFUHL
TLSH
T141155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 909KB
SHA256 bc4df4b473f386b4cb84796506b764d0ef45b1f751902c3d93b3a7eda1e0b360
MD5 5a77ef5b83f52c19b4d0f6a3596a9c3f
SHA1 3db7f7b32c508ec0d99f4a9ac6deafd80124cf2a
SHA512 8e58ec3c6e540ce89c85dfdbba21faafd649a426f9532341100fe38eb975d4c7bcd53ca805c1f31d99205a94ef47fd91fedb8423d2808888d82068f21eab8f04
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuHk:WqFgqFUHG
TLSH
T16E155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 909KB
SHA256 0a08acf004d1b570bcd646483b9ed26cd097cef93d01c64003da57e27b125b46
MD5 cb2c105c87c4ee3855d70a1542c71fed
SHA1 ce150f8a01b3d8e4de9434511702af87583e2236
SHA512 39ce97652318c89bf8e3a94831a235a3cf64cc232141c7d6f13e90e87651c97ea99bd2181e9cbb8fcc5f3046ddf67239fc11ae4cc073f7c65444e867a237203b
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuw0:WqFgqFUH7
TLSH
T1B0155C06E6A104ACC51F8130C7A65371BA73BC2156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 909KB
SHA256 d22ceb1414fa5ac8637b31f9ccfe9d898240c60b43852f7a58a992faf3a607d4
MD5 2b8b0d8a51ac7174684c52c7882faeb1
SHA1 64b484c9fd71ee65411ffa8736a73386b266c77d
SHA512 bc00ddd00414e95308c4058d6c6ce292b94cc256e0d94db9fa46b932ca43d1bbf77848640194c6b56cce27033ccc997fe11259c05f3313fb0ea539f8cf6e0e14
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuLg:WqFgqFUHO
TLSH
T116155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 909KB
SHA256 089457fb7a7e8f16b500bfdc31b3764dde5da2a891067caa12ca25e046a570ea
MD5 6831ec3ba34854a36b1dfa46f798551a
SHA1 70fad92a9dd017084f633822ccc9ad7fb7004273
SHA512 88a02af2966fbfc300ffd4d04452289a328f1259bc1ab9e1b550e23092ecc87c14e71d12f12cecf3761406abd2fcb45eba58e15ff0c786a9235db66b4b5279e9
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuGr:WqFgqFUHQ
TLSH
T103155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 909KB
SHA256 fc67da543819eacc7e1e7ff283a6553a340b5d5541b9e0e9bba961d8882b1016
MD5 b1233e52dc1a40d5064aa41c97896e53
SHA1 a868cc422fcee13f968406fd58879754fbc085e0
SHA512 8ed6ca99d30334996a03446cde6df1f188d14e89900f6444e15ae779003b96d99c62cfab172393aa1926f19e8d8565003a5ea68fbfa25a4597aaf39870a51ce2
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjusn:WqFgqFUHC
TLSH
T120155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 909KB
SHA256 375dbcc8720f19fd06e1f5f18d0fe1209c06f57c5cc76be1596f6ee1442598d0
MD5 343811f326d6c839a43361ec773eadda
SHA1 454627009faf7c8b2d4c53cad3d12b4d6cde1a00
SHA512 fed119bb5788f3266dedd4e12fbbb0882a1f68e1bea78cd53b94978c25006d58bc4b28475ef67f638e6b3ec2b130e677620423851354cca2864197b34aa493f0
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuKx:WqFgqFUHw
TLSH
T1B1155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 909KB
SHA256 6af2001752cb352b1c63abbf5be00f264fe6f84ee40e5fd4a65191f2063a44af
MD5 a5ad384419a0980940bc81ef3a83117a
SHA1 abe5bc9fdf8d57aae39c58b77b64854e62a22b38
SHA512 fda69ffe5e81a0137450d642dc5497432334617d646713a1c3c8f7356e35cc445b204fc0f3bc79fc93feef15ee3c57a23a9e9e19fdf2b016c0a4b6f18d682a15
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuMA:WqFgqFUHT
TLSH
T1A1155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 909KB
SHA256 9345de23890f5a996df18faa5660af62a14e5462bd15cfe88a2a3aa4d6e720d6
MD5 6dad72f54608f6a8270fbcbcf08039e9
SHA1 b85422b2bbd16cdfe453e6a10aef13c43788d610
SHA512 ffdbc2455f2c80c3852be2018b1905be61b3aba6fb6b7e2d414ef73724b08051f44dee4efb97c0e7510a2005ec4e9fb512eed0065cbf2dcfe158a0d6dc580d11
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuV9Q:WqFgqFUH+
TLSH
T1A8155C06E2A204ACC51F8170C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 909KB
SHA256 c4f5c562ae2fdabfcce7076b35f84d558df0968b9c66eefff388d3e4825fc583
MD5 8cbb343cb2c6b420cd850017bab96534
SHA1 3dc7020e1dacaf947c0dfb2fe510723961f8c144
SHA512 0bbaa593a52f82804062aff58bb4d5b93944b81b977650f32b15b115f30bdecfba36217396cffed1eb2c5c57cc1ace94a5355c0f5caf5b78e28afb59cc6eab82
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjug4:WqFgqFUH9
TLSH
T164155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 909KB
SHA256 04daee36ec745492060e71d85012d8faa095f6113fa64baf69a7dd23ab75ce27
MD5 18c535e92ea69b567b62f5f29e94f4ea
SHA1 1b74a0c29bc1a104c541b57aedc696f695f17d6e
SHA512 166f0aa346a9d0e86130ac5ce492827a0b0496f928d3b5f98a109b06e17d656a6cacfa76abcb17a04228ed1563543d7233388a5f2aef407fdbf8a97a36ed3bb1
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuDu:WqFgqFUHY
TLSH
T13F155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 909KB
SHA256 2a8f50b1adcb471e2b377dc06b2979d339b6c1dd6201f6b494172de20d08a056
MD5 75af62bf83379dbcc8d7255b5acf2258
SHA1 f24d15f8f9d47f257d56844d51eb52911013266f
SHA512 fdfc3c16353201705472c72c983b0f9ed2886a35a4f2fb4540e9f0d8708919db93ad7c813277ee574f142f25b2e154de6851ebec2175c9adf7efdd28751a25d1
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuej:WqFgqFUHy
TLSH
T1CC155C06E2A204ACC51F8170C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 909KB
SHA256 a1bf7789d4756ec40f3e0217dc58a00429fcaf6208d2469bf00b0231ea1f8b4a
MD5 ce30c99732fc32fa665d13e7da1613fc
SHA1 55d34ee53c1cd4842825811754f666932a99374d
SHA512 6e27af8dc33dcc42595d8aa02f2d0aeade36febef5dd487eb751391ab49dee9e636b4f30fa4f6a71c94d0a6b68b96c29bee3d5674694b83f73ce9bb9f4ec2601
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjurg:WqFgqFUH2
TLSH
T17F155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 909KB
SHA256 d13b37d95766002a3860d566b0d5f76e84292f466e25670a1d9c1ee4c4f6d697
MD5 4b2827c6970bd19c04e3fb14104ed85c
SHA1 7a4d9f15bed8c76d4cd122bc6b9a47b3247983ff
SHA512 d03bb5f889f1f3bf6128036ba12d666e8bb04b675bce72aa564e0cb5f14ca8d12b3db62e0d32fce4af221e84afde49ae13145823ba6003599d3eb196fd65b433
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCju2I:WqFgqFUHf
TLSH
T119155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 909KB
SHA256 3a740c8fa92290273412dc2541f71811ffadb0cfb85a98a7ce1a0c5493b7914a
MD5 e4fdddd568c0eadec443329a397740f9
SHA1 d63ccc8e37b9d7f7970d684999904c495c251262
SHA512 7858f1c7db89f33a933143dad34ca987cfdde09f30dcbe0d8705564c2b91fcb7504b97d967cdb03fbac0f494cadd74015b03833233222ffa40d7983e189e6646
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuko:WqFgqFUHJ
TLSH
T179155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 909KB
SHA256 4420ecabb178de6ab505ffbb5db558b10752c48acbe9e43ef0b470ed0038bcf6
MD5 0964f891a61cc02b0278341290fc0be2
SHA1 b68b892d50e46056a89962fe685fb7e08906dd23
SHA512 6940cf870d090ba5e4704145a6df105648444490e77ef322811f75cb3532afb2df9ae9bcc127cf94d33260079745242b8a9b3a5266e27a0c9884431eca3b715b
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuH+:WqFgqFUHs
TLSH
T1DA155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 909KB
SHA256 c53ec64bc8aa9dd58618b89f55b6c218bc9a757a975b250a8a63087b446ed017
MD5 ebad5e23aca31bc59614673e9cfc783a
SHA1 2e2ba4f1f2954acdb18578dad89d8404ae0a2ad1
SHA512 037e142e845b60b161199ac9890a0b542e5c6831a3de6c7177824ed0f17359e191c807c4a0be79bdb315733929b199e4091cb6ba42ad179a20f13f538a0ccd83
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjudQ:WqFgqFUHE
TLSH
T1EF155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 909KB
SHA256 1620aaf34c028db26788098c300530239c6df55af090d190cfbca5b8c58af237
MD5 17841a326a4b118fdce9cae3038caf18
SHA1 b1e9110abfded9003a15bb8044c754e2822b99db
SHA512 dad0ef677631dbf69a5f68caee8fbca0fbea268005fac1d4603d1fb52f8077e844d02fa7eff11698e8bb0880c925ae533bd4e5eab1ed70927dae00296694f5c3
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuSX:WqFgqFUHk
TLSH
T16F155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 909KB
SHA256 1602830a0078137efa1df0c5ebd6040074dc59d1b31dcddc03c4f09861a753e3
MD5 201101fac47dc89cf648e6a9484445a5
SHA1 1c69d9f80f97fb24b3620c8ec661a0057285579f
SHA512 ed6887497e915bacf4dd8102ad9a952348e97d9b40dc7ba1bf9c8782c31042c3c82c4f07c4657e5538e65ea37c19c658a8d8ea5487ea73babe93ce39a8331437
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuUL:WqFgqFUH+
TLSH
T133155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 909KB
SHA256 dfc1cf927be2d0461bd381248e32e15c647563c62ba30aa566905dd68f29155f
MD5 7475eff201082fc2ba14864c300c7bb5
SHA1 0df28b51283b5568bdb77617271c6f081477f299
SHA512 ce77d16b8e3ef23fef8aec63e5462221dff91fd484c3ad5b0fa281d143c52ccb6bedf2650b2528c670444ec9061a9f2515610af35450df446abad4a3ec3247c3
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuwM:WqFgqFUHL
TLSH
T1DF155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 909KB
SHA256 5165219930c629c9c90e943e28c1a63066c8bc3fb328b63b70da32b4b9a2b362
MD5 5861762d4cfcee3cfeee044d5860b02f
SHA1 8d5629124f165e0b3eae93490bdb40cab5a40422
SHA512 5f7566ecb3a83925fe34726d5e1cddd0a658a19a3810ada3bf943271ed72c23dd1659b2c9c95973ba16ce842a79957b065c8a7de180f5ae7b02807388ebab819
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjuxh:WqFgqFUHF
TLSH
T181155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4456-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4456-1430-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/6328-1431-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads