1e94ab9769982f6e7270ea3e58a8ff67d620710760c970f1a7b96fc5de57eb74

Analysis

max time kernel
113s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_b4c71e4e427aa84ccc31619873a0b260_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 839KB
Sample260808-ddg13syele
SHA256 1e94ab9769982f6e7270ea3e58a8ff67d620710760c970f1a7b96fc5de57eb74
MD5 b4c71e4e427aa84ccc31619873a0b260
SHA1 8cde4b808679ecc5b3248f1fb2f5ba130d4c0dbb
SHA512 78dbb9774b0a9cac5aaadccd043e0153a2aec29cf2e664413b74fd499a94f6f84be4cfd04799073ec86247c3b928bc53ace412c52cae342dadde3c00660facdd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CF:A3k03kB56rn
TLSH
T131056A17E6850FA4D00FC1749A968672EA737C025F2093DF2358AE153F72BD06B3A697
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4936-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5ac-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4936-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1368-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb5-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-438.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-518.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-603.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-628.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-630.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-710.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-778.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-803.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-910.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-956.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-981.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1012.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1055.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1104.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1142.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1187.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1200.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1359.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5ac-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb5-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-226.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-263.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-438.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-493.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-518.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-603.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-628.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-630.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-710.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-741.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-778.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-803.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-852.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-871.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-890.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-897.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-910.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-931.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-956.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-981.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1012.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1055.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1104.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1142.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1174.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1187.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1200.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1327.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1340.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1359.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1387.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1403.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1368	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-08_b4c71e4e427aa84ccc31619873a0b260_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_b4c71e4e427aa84ccc31619873a0b260_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-08-08_b4c71e4e427aa84ccc31619873a0b260_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-08_b4c71e4e427aa84ccc31619873a0b260_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-08_b4c71e4e427aa84ccc31619873a0b260_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-08_b4c71e4e427aa84ccc31619873a0b260_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-08_b4c71e4e427aa84ccc31619873a0b260_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-08_b4c71e4e427aa84ccc31619873a0b260_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-08_b4c71e4e427aa84ccc31619873a0b260_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	2026-08-08_b4c71e4e427aa84ccc31619873a0b260_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-08_b4c71e4e427aa84ccc31619873a0b260_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-08_b4c71e4e427aa84ccc31619873a0b260_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-08_b4c71e4e427aa84ccc31619873a0b260_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_b4c71e4e427aa84ccc31619873a0b260_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_b4c71e4e427aa84ccc31619873a0b260_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4936	2026-08-08_b4c71e4e427aa84ccc31619873a0b260_cobalt-strike_conti_elex_hijackloader_vidar.exe
1368	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_b4c71e4e427aa84ccc31619873a0b260_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_b4c71e4e427aa84ccc31619873a0b260_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4936

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 839KB
SHA256 1e94ab9769982f6e7270ea3e58a8ff67d620710760c970f1a7b96fc5de57eb74
MD5 b4c71e4e427aa84ccc31619873a0b260
SHA1 8cde4b808679ecc5b3248f1fb2f5ba130d4c0dbb
SHA512 78dbb9774b0a9cac5aaadccd043e0153a2aec29cf2e664413b74fd499a94f6f84be4cfd04799073ec86247c3b928bc53ace412c52cae342dadde3c00660facdd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CF:A3k03kB56rn
TLSH
T131056A17E6850FA4D00FC1749A968672EA737C025F2093DF2358AE153F72BD06B3A697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 70b70422fcedf14be71efd6def701f43b3f9fa24d5be55aad0494b073ff9aaf3
MD5 6d50ca5e9c6f8b4ab6145df12e175bc9
SHA1 e63bde2b211b53a34f84a0dc09b98bb1ddf82e57
SHA512 2446c6b8e1e4a49c6d12e0bebf83d724d2b5236b45f555994e62b68a7cf7431910ac77f8760c67d8230157916988ac45a4e5fa0b970e693d423b262ee1c7a727
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CB0Le5ji0hmxNrM:A3k03kB56rjPji0Aj
TLSH
T13A655A16F6A44B65D02FC078C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 853KB
SHA256 09123003da278ca40776e55f059df837cb602b18488923530a92df366a30f246
MD5 65c406cbc1a4f58b6e7c637859956ae8
SHA1 0750725ee4851fb8f93ee362d51bf6207d89931a
SHA512 30f77375c76b4f080ea3559de34dd52fdeb2661c0a43ee043401edb47c99a83b0e08a49fad294fbd367623e11a2bf631f35650f77a2bee00550b2df0aebd718f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CDa:A3k03kB56r
TLSH
T185056A17E6850FA4D10FC1749A968672EA737C025F2093DF2358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 886KB
SHA256 4acb4d8fb7babce652916d8ee747883404a3aa46fe4be22a1e6b35f20d14409d
MD5 ad5e1d2b85dfcade8afa7acedf45efb3
SHA1 9bfaa468725179651916f30cf530d8685a273d11
SHA512 b46615ff280bd604c5d71d8ebdfcc860f70d7b5b842e8beaa4d48533009da40283974793cd96094f1e9ad4c6ca15a3c34235a6d2567fc359104529a5bbfa46e1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CQb:A3k03kB56rmb
TLSH
T118156A03E6850FA9D00FC1749A958662EA777C421F2093DF2358AE153F72BD06B3A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 862KB
SHA256 efe5cd5405bd0d4b657a79d3b1bd0a3b3d8707bbc163bf7826440902ba05900d
MD5 cea904207f8f1ffffbfa0299ebaa41f7
SHA1 fd596e07db691b093c012c1bc5ab621641e6a021
SHA512 2ea324f07550917dae76dcb1070bf3269afbd3a66648b48b94957dd7e1da177930ab63c64332209de6188f5929674586b948a56993d30fad1ff41d2ef0c809c7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7Ci6:A3k03kB56rL
TLSH
T1BF156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 862KB
SHA256 d7dbe9a771b3d08dec450c2bf5f95ba8d4956a16fcd9135bda28f45af3012cf7
MD5 3573225d4a891e1b53ef9b02da6f7d32
SHA1 e275aae35ea960157fb051efae22f70dd5252df5
SHA512 c0dd2eb2cd0475d366c0f86d493a37dd81809d44bea9736cb8169a9dbbbec29c17632a4933f518ed5783cc010fb709e439547df62573247a7cbda663024de307
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7C6N:A3k03kB56r2
TLSH
T14E156A07E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 862KB
SHA256 ef96feafc6411ee278dd1607372aef5cb5ec2ff017a948df165c2d5ae1ab8257
MD5 e1d7d985761461942499cbc8a68cdcc6
SHA1 a8f5324ca12b58a1cdbc3e1063ac96498bd682d5
SHA512 9a0c390c9c3b414421020c2c2d213eb7ccd5d8c849a6b79dc1889ca3f47153749d5f01e348ab67a7cfb3cff20aa48e6373c80fa4f532ef3aca593830fe90dd83
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7Cgf:A3k03kB56rK
TLSH
T182156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 862KB
SHA256 e2132d5d826211f946935cc49fe36cc75690bcddad1f0026240749b4caa2efe8
MD5 1f4293c0c3b5bcd4980e476a2aade5a3
SHA1 7273b986c66add3f3ec60575471f956da1db6edc
SHA512 8711e62f9058e9effe0b35063a1d9874c23e704fd683a0eec531e28acc2a0138ccd4246f49fa2ee3e78027fa99813582011388ac760b5d6960de4961db42c24d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7C6o:A3k03kB56rT
TLSH
T1DB156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 862KB
SHA256 085cd53cdad3a10321829778e59afe035cd8b703d568688e941cdbbb5aa1d8bd
MD5 8c511e62e6c34776f145ce80b0a23c67
SHA1 3ca0c4ecf2e8ce8022784f8532c6c879d8e3edb0
SHA512 4dbfbadee697e30ae1946f38006ecd6668e0d0144825d14ad279840a3752d14d17e9c3963e848d58f5c84771473d117740af08706d3cd6b763bbb792eaf6ea4c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7COu:A3k03kB56rF
TLSH
T197156A17E6850FA4D00FC1749A968662EA737C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 862KB
SHA256 149ff95bd320700b5eedb6a1ed22bc727fad13292461f4edada88e3d26904b19
MD5 de60393e209a7486a7a7d1a066e1233f
SHA1 26ec16ac6a098848eb3fd526c6513a052e298f25
SHA512 1bc0aae0a30d378a30f9b4f736b8a529392ef703a7e0416ed05f292504998a5b5b8b8ea055b4d61bbff4ad75a73efcf1aad94291b0f4a9be878725e5d9182a0a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CC9:A3k03kB56rw
TLSH
T17F156A17E6850FA4D00FC1749A968662EA737C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 862KB
SHA256 148a2dcfafeacab223735b9668850ce2c6c0381b3f3a5868b53ec6688954293b
MD5 70d3b4c40c0c440748bfbb2ce7e54f04
SHA1 01d24d80d98ca3382617b653bca2e7c093908070
SHA512 aa04e7d6b3eb8dc261d310bb0d14cc3aa93d21961490bd9e9d1a415b74234b027dd651017500116612b616a82d2cb088e1f45606825b54537b1dc37479f2c331
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CCc:A3k03kB56rh
TLSH
T12A156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 862KB
SHA256 e08f3aa6ea348cbf5ee6d84f606ebb084c19e5006bae11b3a001e69c8ddafee3
MD5 50f5edb004532d927815ee5ef6d2d684
SHA1 a0f351f6d94e097d81e49585e3532a3ec55247f9
SHA512 002e5acc448e397ec5b91405ffda45cb054917cce109c0fb991056215b313d126998780022cee924962193f86e932d70ee7e88486cdd804247582fe9243bf146
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CLp:A3k03kB56rf
TLSH
T136156A17E6850FA4D00FC1749A968662EA737C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 862KB
SHA256 1a8dfe62298250f4419765133aea812fe886915b1da36a5565993719149e2d4d
MD5 f6a57a14d233bfc274b046eb94e8ce95
SHA1 7d53af32d077d7552a73e26b2cd85244c1f39767
SHA512 83f04f5f39c35a85c10e26bb514f4e5c29a6082db49d4bfda2fae42a76efc41f7d367cc862dfcc1bb34bcd99c2b6bee7e9aa380e79e292608087ea2bb23e1d71
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CcN:A3k03kB56r0
TLSH
T1E0156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 862KB
SHA256 10fc3c0cf17f17f854f0e78ca41b7af86503306dc75d30a9f2c98386418f5c7e
MD5 05ef6a309dfe43567f08a390437043de
SHA1 83ac649823b60db7d1ad3385aecda6a3590346b2
SHA512 98ccad556044d97f600fc9572abc60635ee0e7973b36a273ff86286cfbef6e0abba5888962afbf8260b01c5e727b0abe543f0718bdde0c5e6c071cfd4480a0de
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CEF:A3k03kB56ri
TLSH
T1DC156A17E6850FA4D00FC1749A968662EA737C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 862KB
SHA256 d56bb8ed755a7ad4183bf044fd6c68233bb7081ba79f3d8c10350f6199ec6ca7
MD5 3e5dcf5688b055a355e92d9de4839028
SHA1 1f931dc1f6518f534abbbf14e692c0936ed42080
SHA512 4e2880f66519036ddafc395765a59e7ab7399c84694ef2f12d320406ec4919971562371fae3df95d56045496df7cf76cebd65b0b5c4aca13b89adc951ae9ffd6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7ChC:A3k03kB56r2
TLSH
T1B3156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 862KB
SHA256 b689cc53b50dd8a644f1d7f7701c4725ce32c60fce28bc99907d2ae54213c008
MD5 0b463b28e9746d1618df5934221a14f2
SHA1 ca4590d8728084fc80e1091550ac9b3ec67bf3af
SHA512 ee8c691e8375f884f985900d12413fc75ea4f191d93358623cb0f0ba6f233f05cee739bdf8f86a75aad53ca28252aa2294696e638331dfd10041a3cd2707b364
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7Ciw:A3k03kB56rj
TLSH
T134156A17E6850FA4D00FC1749A968662EA737C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 862KB
SHA256 14be9796c32a20348e77899bbf3874d97f1aaa21d833b58a7b95ad9c0de86f3b
MD5 81b1e4c45854995743d0cfe9ec91df3e
SHA1 07b18abd7f9ff6ac923d72c6aa0d48cdc103d049
SHA512 8dec2eef1627aea257d90148e4614e90169befc7557d02dc0c58ecc220506cb3576d34d07533d294cb63fe81ee56a144bd162461272e10e7b2ee6796e2716d5a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CpT:A3k03kB56rv
TLSH
T154156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 862KB
SHA256 b3f8311b7481b06e7883345188120f7b4339253902777096e587e74d2cfe10af
MD5 78693f45e7f98d9763daa2f80f82191b
SHA1 10cf812b1ea4b35441474b0a0499e34aeaf334d4
SHA512 9b3f19737ba718c967446c0e4435d487808b3853aeb409634424f0a2c9cf0b7c70807474e5e97f66bbc6fd17ddc82fa06e5c4c8ac15f6bc7adac4cc97f4f68f7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CHu:A3k03kB56rA
TLSH
T132156A17E6850FA4D00FC1749A968662EA737C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 862KB
SHA256 a0168d98d07e1083eca2cb834be51d7749c33579328e4c20bfa7e8ac42ff6b79
MD5 1de590bdeecb61ef0a3e82977196114b
SHA1 af76606fe94c62a109f5c72be557030aefe18bd4
SHA512 37a461ed618915ad0f38adcd6622f8104d5fca0f02dfb45cd78d0f231afb483a16ae0cde14e8b342c5216084714bf15687280633e9a8d04eb0686258bc50e3ad
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7Cbb:A3k03kB56r5
TLSH
T120156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 862KB
SHA256 5cb1bde1d9a842e65b992dfc02225b617f669568546897a0c4b5b910bf56ee4d
MD5 1380a8d669743377db401ee42cdf6fac
SHA1 97fa6fc0003da67dddb510cc464259ff3e29cde7
SHA512 a202e09a989ff464e33cceeb96e9e9166ac3433bd72db5e4fc620e76296fec4e23f260d8917c57ae4eb07408f9b7459b685b3437f1f5324e59c374e802c3b075
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7Cvf:A3k03kB56rJ
TLSH
T149156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 862KB
SHA256 a63e184969d9f6ed8f8c87f4a0f17ac637c97ab041ff6ff4349037495d23eae0
MD5 11eff49ff6a3dadb8216d1ef3cf31871
SHA1 d7e9b82c8fd467eb401d22be696925c9386ad794
SHA512 a4d1396fd323183ae310629cb116f9e8a79897ee0ceef9d2ad04947764a68f327ecd611b9b230e0f85363d900328f0ddec234dd545a16ff357d501078a92d6c3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7C4K:A3k03kB56rh
TLSH
T11F156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 862KB
SHA256 72d1563d88d7031e150475f4d56d03460fa736d399c8af7f7b88fbf9db667563
MD5 97f9fb19293d8c88e5e848107568d5ac
SHA1 2c09feecacc1fc9d26a9011628d3337461e5106f
SHA512 f44d78a3898823ff40c1b7fc72a90fb33169fb2bee1427c914513efa526197bb24cb812f731ed2305b4a39460db25badd258114cfb5744091b5095d050a55829
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7Clk:A3k03kB56rI
TLSH
T103156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 862KB
SHA256 b05de0e00afd559ee46f9ec2cda2ba193ca684bdddc53421b9c20abfcf910082
MD5 068cca7929a4161f341091f377fa0c92
SHA1 2f8828554df62c18f5b925c7b804f86b6a548457
SHA512 d457191024e81f288d80ad0c1a6522b7a91dd694d690a9b5a348bc1a204b0e30376533356a05eacf9e5a905140d74d32e10ee8f0dbc279e0aef762704352b475
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7C60:A3k03kB56rh
TLSH
T143156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 862KB
SHA256 d3c4497cafc1f0a2543812644cb4c3bdb79b1c2ba6828c1807c15633f5f85df1
MD5 f605d748bcf3f9d4b35fff0c2b76471c
SHA1 25c7a1750480ad9d5f307eb35cb25fb67cbb97df
SHA512 d505c97b80899b7b3303bf3bd247deb7879431cb9cdd294d6a413a8508c2e61e4be049498fce8feb87be1a15e22bfd5801bebb13bd233e221e325f4382575a7e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7Cpg:A3k03kB56rg
TLSH
T1AD156A17E6850FA4D00FC1749A968662EA737C025F2093DF2358AE153F72BD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 862KB
SHA256 c953510a795241b6a74f94a9de5202e399fd20dff071f6fc8936216d1dfba5c3
MD5 a7e8c2cdaf6d0d11e28c19333c219966
SHA1 194f0a1a0d5d7ae075797ddbcb977d54d32590a2
SHA512 1df0b36fb5646a8208f845747981d06db507cd867f026e7e0ea3601e8eba4cf75969c6032c1289136aee7fcf553c5d3ac6e72ca7a3753f671c2eb25e7f4f4e99
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CQr:A3k03kB56rq
TLSH
T151156A17E6850FA4D00FC1749A968662EA737C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 862KB
SHA256 46691ae057cef8ffab00be61a0449500fbc643bf52b56b4b230894bfca51f38c
MD5 cd65da92993939ea5048d2934f473f90
SHA1 729ae09706d90a92efaf4b44dffd7e25286ed125
SHA512 2e4a2bbd94878343b155542cc52520144765076b31b5d2a175e3106f93faf519ab323a54de4dc61d747576befa3d54f873dcd7effad65ba8ac7f0b2fcf75ab67
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7COn:A3k03kB56rs
TLSH
T1F2156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 862KB
SHA256 bc71b0159441ec0ce50ce7bafa9abae87c6408009708b7f719b0fa24310f0e5b
MD5 5b79d82fea1766fb737fed3052a9b08d
SHA1 d62653bd8a3aaef06044c4e430372de8c6ffc962
SHA512 ff31013c48643db70c469a6458eff56c7508c8f7a9aac6ceb32818dad2ad1ee79f61ac2bb0d27e5fda69ebbc3affadfc98521b0e1ea0ca886049a6c207030c2f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CEx:A3k03kB56r6
TLSH
T110156A17E6850FA4D00FC1749A968662EA737C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 862KB
SHA256 69c0ad29216236ff682d0296e71aa4a6fe6eeaa271f7dce0ec3b682b0b9eddce
MD5 e0d01f0be11e5d65e95b9a6ff806dab4
SHA1 2c586dbdb978471ddd6df1db3f139412aa0ed165
SHA512 21b0b7a4b235f768f73815eda07ba7dd1c002b77d5a16b062732fe5db7813bbc1bd664ed403989c931707fa3207dc22db6c0de77e92e6a391acb8860dcd03c1a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7COA:A3k03kB56r5
TLSH
T195156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 862KB
SHA256 3773db50a679f34888cdb7c843f5d62d3c6ca115b493214c9e51855b369fbb1e
MD5 a448dd2ee5c0bf54825395104941eca8
SHA1 05e6becb4b82cb2fdc26644018a7533f43350b97
SHA512 1a004869fdec704f31080cf683301c4924a6d0b26ec9cb48ec6c59137c4897785cfa79687458a729680d71f961bb0c9b61c9890c59121309c1586e178c45c5c4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CH9Q:A3k03kB56rg
TLSH
T1C1156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 862KB
SHA256 3383b88b0ef625502835ec1b829996272267f366dd63218743b0f77c07ea5693
MD5 56d5246045adb626f9f9e4f1f0c97147
SHA1 6801c836630d14e4ff50e3acfd63627f6ce38921
SHA512 b79bf9e02ed749f955f3e7135c03cea7aae0d567de0ddc6cb353d9c0666672c66bbb7cf82be2df7d5be11c863edffbee70017befcc8ce3dfbe68f0822068b8ce
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CO4:A3k03kB56r7
TLSH
T1B1156A17E6850FA4D00FC1749A968662EA737C025F2093DF2358AE153F72BD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 862KB
SHA256 9665335a57c3a899906df2f1a701bf6c32ed40835fed39d5360d0fb7e75b340c
MD5 568fbd2827a9d77577179120881e97ca
SHA1 aa70da134c636763b729ab93276e39c07d01148c
SHA512 65633675cb2d01d5cb9739a1083d754ac398e918d69f35da11fddfe6710348757c8692a3ff9dec5d38b313ffbd11f86bef3b88186994637100820a14b5171332
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7Ctu:A3k03kB56ru
TLSH
T16C156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 862KB
SHA256 a22c639550069cbfb46f219a3c2e58a59738f40632e3b4ffbb09440031f6a89a
MD5 31ba5e02a844fe8ef63e731e6b432c04
SHA1 ef27597c2398d81059d2a6e35ad393560b0348c4
SHA512 d7717b4e3fb57086e0bbe0def2abeed6245f00962209eb48faf3323c9c1df4e1d2ad56574b0bc11d9655b8a99a011d37d21cb90f9eb638817099886401b6f317
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7Cgj:A3k03kB56rA
TLSH
T14E156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 862KB
SHA256 2a5c961a05c4ba1f71c812a66aa0a761b04956ccdeff5aefcbbf5d38f810f9ea
MD5 4d7eea0827651962f63cc4c126966c16
SHA1 68409fb6d1cd99a5d909b0365358ccf7bbcbd6ec
SHA512 2aaa82d128f26d2bd0538ffe3c3ea5cda740bf97fe6e2989cbd62eaa2cd74b257f4bc479e31031d3f932968282d9a04fe7afc90ef5fe3abe691fb50641055fff
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CRg:A3k03kB56rY
TLSH
T112156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 862KB
SHA256 251476a00f58a4f7af545436b8a6492455fcf315624cee9a4a9036ea3daf26d2
MD5 9296f91664a03a4210165c2ec1369237
SHA1 f14991da58c79485b0a758b5b0d63872c72b3608
SHA512 cd9ce851750e4d11c17f7edc5eb28f4bc5f57a9e71fa61839db1505fe9fba937f72e53988d1b8f2a14d6ba5080c9e25b16088e2a1d603e3a442e97bb40a0349f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CII:A3k03kB56rp
TLSH
T12D156A13E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 862KB
SHA256 4fab11df254b77fa825333fa757f54a080ffae7e528337aa0c8e7760ae5080d6
MD5 f89ee7908d72dca398a390ac1890b92e
SHA1 06aae7e9fc10f43106dcf5d19a87bf5ad25f3343
SHA512 64aab28f722127b9210ea0fb63c97e794711d02becb515947ff52a2629384b70c21e35d5b97a9c4adb5806472d0f809d63628ed22a8397535d22b7354c563dc6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7Cqo:A3k03kB56rX
TLSH
T108156A17E6850FA8D00FC1749A958662EA737C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 862KB
SHA256 064010510360991c9ea63420aada763a13aaf2ddf7c885df0f711a67dbee184c
MD5 3e636525a4c035d4768ceaf359ee754e
SHA1 011781c44901a8868237a0889e4cd13afb14d69e
SHA512 00871c0ebdd21d303a2c0f4a2f2d9d5bddb3c1ec4bcbb0b29030800fe63f2d46a44692ad2ac01960588736ac248e4ba34067c092cf51f546dbb29281eedb8c1f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CB+:A3k03kB56ri
TLSH
T11B156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 862KB
SHA256 f7bb873ab4c4bf021a310f698bf3643311649a48312dcff6f69293de602ae19f
MD5 2ed8f5dfd032d432486588555b50ad45
SHA1 ae9c88adb23e566de923add35560af358350b28f
SHA512 b55e05be279314f29e5afac647a2d0f838e4da29952ea1701920b94a83c053af39a390a3acb9e957ae9fe94f4bc71e1996890afb45fc77c61c46a2b52df47d3f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CPQ:A3k03kB56rW
TLSH
T161156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 862KB
SHA256 6d5a6e96e7f652c431f0761b795cd9c59c1a6eeb710fcf0b1ee27b7ca930acd3
MD5 87ff75c9a126aba10aeaf1cf68af1963
SHA1 4a206d083cebecfb40db0febe797b22ec60d6f39
SHA512 0be6f88c738a700a5f1047b13e34442ab9be74a80834177833d2d19d4ae8dec709a2492829546a8edd1a6af22d2ec451b1795fe50803a664e790bd3fb884eba0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CUX:A3k03kB56rW
TLSH
T156156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 862KB
SHA256 24fd5452493b048534d06faebc6135066a497bf96b8ce2d5bb1d176416a5946c
MD5 e87c56e1c1a89e989c0e0b902239d328
SHA1 419a82b9d503f9d35d1a422d371322a55a31b089
SHA512 ceb6b212cac80936ceba32ad17047b6f3109aa53d2368107ae0418d7a6f1a55a94785423e139ed20eb119d2a7dbcf4b0b40ffbf11b05b206a4cd8f3766d3cc48
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CyL:A3k03kB56rY
TLSH
T128156A17E6850FA4D00FC1749A968662EA737C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 862KB
SHA256 488729ac95556c40e644d5546d3021686b6a4d641a5842bc0b431c61b1931534
MD5 673ef8ee4e9a85c1467442481a92ade7
SHA1 47ed73b6776fb7f17f4fd3af572517a49a1ac1fe
SHA512 14295d79f8e37da271acde50e681dfe427f48c92e7e05a7d5a0daa750fd781c5893fff038976004b5f97cbdb30d5b5a5dae0d74b11895c74a4a2f617d91599f2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7CWM:A3k03kB56r5
TLSH
T178156A17E6850FA4D00FC1749A968662EA737C025F2093DF2358AE153F72BD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 862KB
SHA256 d93ee0af2d82e082d2b92ac23d210fc524ad93d5b6b4d16a9f4f5822bbedc5c9
MD5 3fb19d16ef0c5aafe60621f3c406210a
SHA1 85fa67bb8e11ec8e552e81bacd68d8e43c5b0152
SHA512 a6e861e804331c21fd8f74d3aa670b45c788e7003e883c2586230e2d58ffaaded2becd9f1707a4bfe5a2a38d0941559b42df9d24cd8aba0fd16cd7e1728a05c3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc7Cfh:A3k03kB56rr
TLSH
T11B156A13E6850FA4D00FC1749A968662EA737C425F2093DF2358AE153F72BD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1368-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4936-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4936-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads