a5a6cbf14cafdf8cf29e05c6e5899741a8d8ede9f6ce3942640910ebc850fc1d

Analysis

max time kernel
112s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_a942a7a30cd8271c2ad4963cad422830_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 927KB
Sample260808-nn95qaem4x
SHA256 a5a6cbf14cafdf8cf29e05c6e5899741a8d8ede9f6ce3942640910ebc850fc1d
MD5 a942a7a30cd8271c2ad4963cad422830
SHA1 c80820023ace0932318934df98cd3974ab57bc36
SHA512 d748f94ac01d9d1cc725932743934d706b928f315a3cd6af18ce440c173c26314f4f4f64838e6aca038d9a64b152b1b8374ce137b9696a25415239e9a72187a8
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7YS9O:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9O
TLSH
T1D615AE17E79014F9E8178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4144-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c59c-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b311-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4144-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4348-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b316-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c95-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5a1-228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-265.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-446.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000188d7-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-569.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-625.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-668.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-766.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-803.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-858.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-877.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-937.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-956.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1011.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1054.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1085.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1153.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1186.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1346.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1405.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c59c-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b311-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b316-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c95-60.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c5a1-228.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-265.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-446.dat	aspack_v212_v242
behavioral2/files/0x00040000000188d7-495.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-569.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-625.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-668.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-735.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-766.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-803.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-858.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-877.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-937.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-956.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1011.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1054.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1085.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1134.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1153.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1186.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1224.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1327.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1346.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1377.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1384.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1403.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1404.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1405.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4348	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-08_a942a7a30cd8271c2ad4963cad422830_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_a942a7a30cd8271c2ad4963cad422830_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-08_a942a7a30cd8271c2ad4963cad422830_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-08_a942a7a30cd8271c2ad4963cad422830_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	2026-08-08_a942a7a30cd8271c2ad4963cad422830_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-08_a942a7a30cd8271c2ad4963cad422830_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-08_a942a7a30cd8271c2ad4963cad422830_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-08-08_a942a7a30cd8271c2ad4963cad422830_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_a942a7a30cd8271c2ad4963cad422830_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_a942a7a30cd8271c2ad4963cad422830_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4144	2026-08-08_a942a7a30cd8271c2ad4963cad422830_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
4348	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_a942a7a30cd8271c2ad4963cad422830_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_a942a7a30cd8271c2ad4963cad422830_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4144

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 927KB
SHA256 a5a6cbf14cafdf8cf29e05c6e5899741a8d8ede9f6ce3942640910ebc850fc1d
MD5 a942a7a30cd8271c2ad4963cad422830
SHA1 c80820023ace0932318934df98cd3974ab57bc36
SHA512 d748f94ac01d9d1cc725932743934d706b928f315a3cd6af18ce440c173c26314f4f4f64838e6aca038d9a64b152b1b8374ce137b9696a25415239e9a72187a8
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7YS9O:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9O
TLSH
T1D615AE17E79014F9E8178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 99446e977bdfa6fa69c82e260055ff56f607093c653de029c33e0087a737f47b
MD5 9fe51ce68caf581c776473cc2d17fc4f
SHA1 5fa11ef195c79e7dc30d27b7076ef0eddcd8a931
SHA512 ec244c26a949029ab77779539170f3df06bc0b459d4993a3afe6dd1ac45408edd7adaea39478574ef427c64056ed9a9b2e55ea0313cd1eebcbd3035c60c3fc27
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9+0Le5ji0hmxNrM:A3kMhT1LljZPji0Aj
TLSH
T12D658D16F6A406B5D073C179C9D29A5AEA7138461B30CACF1398C7292F337E19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 942KB
SHA256 2f4469f0fe2185124c66fc90cd9546c32a66214a163f0e8d9914aa43dc4deef3
MD5 b56a97caa5f02455a0461101261a4b3f
SHA1 577ac617228d98c08f02afdcec8225d1a932620b
SHA512 d62aa531bce2a83185a83aca8c4bd62e4edbc62fdb4cca364c574e5df5e9893b2c6f731de4aa18b8b8d71b9cbd4d03c462ee499c2eeff640d8d66c3d49e9a515
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS94a:A3kMhT1Llj
TLSH
T1C525AE13E79014F9E9178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 975KB
SHA256 2448a8e9db7ef3c8158fb8c1fc7d389722b7c140fd6c5951228bb7a691ea9524
MD5 0849b34cef5b306a0a0397f6c4d6a7b7
SHA1 24c7ec98f5659f2c86bd85488394d0f2291e93c3
SHA512 1c8c865243e2e3277ae3d1988d83155b0ac7710a648c67733988303d0843ef7cb916b94289efad73c6c9ef6d23fa4f8e3232c84839adda0216373a66644dd05a
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9zb:A3kMhT1LljIb
TLSH
T1E325AE13E79004F5E8678234D9A54A12EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 951KB
SHA256 1cf604df19de89faceb40e95f4acaaa75b1163f4fb309d7746be63123f1053c5
MD5 6674b578fb8e8a9fc8a9aed397e64faf
SHA1 acfa52344319a12e1ad455761c1a5a464c32a05b
SHA512 1f0cfe5293cfeebacfe2d792d413e69a0f5db520db20a7702c1c8c528396a84a8e3beccafec77740b85c267a3e238bc9a8626517da86d23189bee74892a02cef
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9R6:A3kMhT1Lljl
TLSH
T16F25AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 951KB
SHA256 099baa8b4aa2309a658179fc80aaaf840b68664e2b39fbb337282cab5ae8c005
MD5 12bd1c0f23a31a545b20b3fc188697c5
SHA1 7e97301c77bb216ec41d7515e1dafc3ad2b3a150
SHA512 b6435da9d3d6e0194a45b962b75375a95d5b59d283ae2121917d22e71599ae5882b526417f6d8304aeded99a5b203b169c4d227c5c0f0783ce74c99dd3250869
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS91f:A3kMhT1LljU
TLSH
T11A25AE17E79004F9E8178134D9A54A22EBB1BC661760C7DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 951KB
SHA256 a7b22970ff859b1318f816e3bc5a6f13c2efdf5013fb0f1abb6df36685cb9394
MD5 91a1982bd8dd41e4f8a318e53e43008a
SHA1 56707aa91a3ea95c0affd522a6c3ab86f42a473f
SHA512 9703c1d4f7999b6f96ec751b9561f16d4c2d7ee11270660de0c5c7558ae1ee38d7c97193e1231156d87e8b9e7af0f7377927b955ef3648c7962aee837640c779
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS93o:A3kMhT1Lljp
TLSH
T12625AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 951KB
SHA256 36e7a33d619c8c1bd66103b4ea9958130d29ce354c610fba9f474c99ebf8bfd1
MD5 10fafd189bca71ba93c6e86c45097038
SHA1 129cae92d15cc5228a10c83e95b6bf1de3c0f767
SHA512 18e88ad853e1160b5a7d594f54de1c464714cc356e4fa406f2866553cdf2dd80b1d4a4d712c0af7bc60f21c5f9feec7fefe8fdd56bd2cdc9a21db8e6ab0f5c19
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS97u:A3kMhT1LljL
TLSH
T1D725AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 951KB
SHA256 b6778687138537aff11e09c3d2e0a62ad7d80ea35791aedab64f6612c02cb73d
MD5 1ebeeb147044de6914c21bf82a6cac33
SHA1 c95d7eb708b06ee8c999c2374d7652cf5c2b148e
SHA512 7e7a9b1371bd5082732f1409690d7ed68e81c8a9754ce6484c41401a990060ad26a2503a15073614b79e72f6accdf6957a315042b0c0f7ba51d001cc5b65baf8
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9p9:A3kMhT1Lljq
TLSH
T12225AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 951KB
SHA256 39093786d17cd996af8c284d8a3677fc25f3eb3c91a7e8d282540a8728fd3c8e
MD5 fc6886e28c52abc67d37591070717e30
SHA1 805faaff5d83dc35f6b84f14873598938868889d
SHA512 6f29038257319cccc6c46731da99e3464577679a392e4c8d8c5242cc0653cf5e330edca698805454db343ed3d23981480d5ff19b2b32c04f8d330b1561397669
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9Fc:A3kMhT1LljH
TLSH
T12B25AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 951KB
SHA256 014fda173183c25b931d4510a739929a9bfadadf573ed46f8de7bd44c65e52cd
MD5 dbc8fa413aedb4d681c768d7e20181b5
SHA1 e88a48a65e7c11acab398ab87c29be8b2f81adda
SHA512 2819875fc0f317ec5f7679ad6e9f2d990f4439e560e661b6aed1a82e4a1e190f739a62dc9849f1952d8aa0f8565bc68a9d5e9d491162bd9468da078ff02b8d11
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9+p:A3kMhT1Lljd
TLSH
T11C25AE17E79014F9E8178134C9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 951KB
SHA256 64ff53159fda119ae21a1ef78e82e37c13669c5d246eb4d290ccc96fe05d6ab4
MD5 516110d9a305e30d29f98c4a33512e24
SHA1 c21a82f7fd40d1d5b5f13c3aa69540644098c912
SHA512 3df7448b9c39666ce08737ec3fcba5e8baca19aabc27b83748fec0e4adf40f9fd5ac3edc0c5ba6dbf675325fbe1ed390073a9e1df86734c0d722b5b20e214798
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9xN:A3kMhT1Lljm
TLSH
T10D25AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 951KB
SHA256 e02aa6af37e575ddbe2cc1273ab619a4df3534d067337004f7c2641a7447b7bc
MD5 b56c814d219f96eac214cadb9333e3d3
SHA1 22814cf9a9198c53140dce9aa3f2bdfcf5c712f2
SHA512 cb281c6bc569cac0cd4e33803d505c1053f26a5f81716f3a13d6c1829461a89874668ddbf8c5f1d491e7453add2e19c8aa4b74e48a46b8e0ebd76f72bacedade
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9TF:A3kMhT1LljE
TLSH
T19725AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 951KB
SHA256 aa50e82d533b172fad51213f06f2a3038211fc9bb49d90f2318c117fbeae4b31
MD5 5db4b9d85c8897299c6d97e1fb1e16a2
SHA1 834a9ff3b6552839f2040522d263ccf3167832ed
SHA512 afbbda368f7d740863acd61909d9407ab00c5a4a88a4bd241f2a8677034e9b8533f8871223e931850d834a5be65d173f10ec53065221d693806d111026776232
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS98C:A3kMhT1Lljw
TLSH
T15925AE17E79004F9E8178134D9A54A22EBB1BC661770C7DF136892262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 951KB
SHA256 d7545d75e15015419fbe4fd54b4201591dc9ed396efb37fef57885c7acf9de84
MD5 beab3ad6bcfb5eacad37509dee0fb099
SHA1 f2e0783d61ded797bcb848e1bce9f4626f1fe7a0
SHA512 e2f86bed0d157dba67a993f027657b12840018d3518cf245452c9e61c944ffa055bbc86e8f66d2e2fbb237827751d3410bd9e6a6375657b39aab6b5a5e5dfb28
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9Xw:A3kMhT1LljN
TLSH
T12B25AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 951KB
SHA256 38f77a418905c212728f7171411be820a735d204a9e79b54b13e297a0294147d
MD5 d57f0271dbdb75196de69e6071002051
SHA1 78933b8150e774da8562296cafbc5481a615d59d
SHA512 5a4d4dd8ae16045b0acfbb0ed62cda3efbbaec0a45e8b8b59913aef7d63583cd6aa08b72be05955de362bf03e3ff901906dd48f618f7b76f89d5327265ab3b73
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9GT:A3kMhT1LljB
TLSH
T1B425AE17E79004F9E8178134D9A54A22EBB1BC661770C7DF136892262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 951KB
SHA256 00a340a350ad8eeb9585f79257d8b95f63989ed2bc54583d2a0c2b2b41248fd6
MD5 0c54c20ac24a32e8ca60feb5bdf4f096
SHA1 55abc704d0c801f2fd280ec49b16e0571c47ccad
SHA512 792da467dac456ecea59d0530368944b0bb30299012aadd8ef86ece29e814e9922f00780eb5a61ee5b5d5b8e7b12bb3e0ad34e4e86b6bc09a127b58ed1616446
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9+u:A3kMhT1Llj2
TLSH
T19425AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 951KB
SHA256 847a95bd685d885bc2afa6c628e85e150dba7faaebce51895933f5a6eeda4e40
MD5 1eb10bcd3db197d45989bfe7e915efe5
SHA1 58f95c365f9a3c5c73c9b40ceb6d1732daaf07d0
SHA512 94e3365e836c0fa59b89dff38e95fbb15fdff699d87335994069f692468d4ee5a0855125d7a612cd5346fc01a4d2b13f598923c7e61463e08091a5c1df346358
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS94b:A3kMhT1LljH
TLSH
T17B25AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 951KB
SHA256 96d33183a70b66d41b41062f02c6b91c551c28bb975aaf05db2ec69bbf472727
MD5 f8388ff90bf29b9cb5d04581a80ecb04
SHA1 bd50782652c351e1db41521cc9d62da06b845640
SHA512 5651df54e7a63a9e5f1f5fe2035eb02d8e7f09aa409fa3655076a7a3e31ce8918a8fc6b288855b41955188afcd38b5fe3f7f4333850a74abcacb5d9a74a4f511
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9mf:A3kMhT1Lljv
TLSH
T11925AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 951KB
SHA256 666e4d436e06d43f2a3cef59c60d986b9197b98e88a2655284690d23e8c9cf11
MD5 596b9ac30a578e867f8513493ffdcfbe
SHA1 1c527f3e44512349c70481017cc12f6197711c73
SHA512 0d30ee84cbb04d7777e4257c39a61d9dcaa7934781eeb81b235ef702bad3bb97530f3bbdc118479a88e62968ab9b655cf4aa0a425bfd89ee0943ce3c39ad0793
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9jK:A3kMhT1LljP
TLSH
T10625AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 951KB
SHA256 e3529bd2143aa06fbd78ca59029115857487cadc07266e25ad3a832f6b31d43e
MD5 91d0965a62a3e81f8d644251abf0352a
SHA1 b82a42382a29527fa5190feaf0d44c66218848cf
SHA512 5efcef5920d8127559215e779c6c17b3a8a3294dbe4e5479a5f6543d132d290aebe0eda3ff134255a6dd13c440e794e4757af7314a4a1cf1f21320247ac49bc0
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9Ek:A3kMhT1Llja
TLSH
T18E25AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 951KB
SHA256 0e48c0efd48c87ebd9d94836f29feb2cb0fa523625fe318a4b146db91849a8bc
MD5 d4576a8ace32f90f720359c4428430bc
SHA1 c0ea45ad2485bc6393da323ccb45a94bc888dcfb
SHA512 fcc42f6e60cca2625a7f59927520f34f6204c3d15490bd84578eb24cf5efba85564f0c80a9658cb93a1b39789866ad0920cea3b966ea3776d676229dbd055d01
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9N0:A3kMhT1Lljv
TLSH
T1FB25AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 951KB
SHA256 1c88c4c7ec5f99068dc833124aaa8bc8c898163ffe46526110b0e28ce00d93f2
MD5 da49b63d5531d9d51d43c7a273f6e2d7
SHA1 6f8f20f5e2ffa74ba93ce5eda1094bbcb42bce31
SHA512 7d560f01eafcbcbe5d2df26377aa07076154559cd0ca43aacc97b9297562d3901ba40ef2643507efc6477fce67aea58a39cbf5f38c688b8d7d1b946df513a2d5
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9Qg:A3kMhT1Lljy
TLSH
T15A25AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 951KB
SHA256 4aeeb4a9c2a33ac21cfb55bf42db3fb2de0e09abff95a2dfdf431fa2eb16c849
MD5 5488efa4ad585f242d2992b6fc38e88a
SHA1 3c4a8f561f215239cb1f059c7a7067dda7d0fe98
SHA512 59a08bb93b5cd1f30c67a21805f7861b3ab0b3f940630f05e048a5317e3c35d44fa1b2b159331033b018ccd346481047b9535f1444f926664e04b2d403ce4f58
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9lr:A3kMhT1Llj8
TLSH
T14525AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 951KB
SHA256 e318e296bd6ba076d0cd7e6b5ef5ff370ee599d4e15a4bc33ac53a94facec9a0
MD5 6f58989de7f3294e34e91b6f867a7134
SHA1 170cba8e7db71f33a51fde55b316d515cc7018ea
SHA512 11c39529907ce7da13b8058f4a5824a4aea7d20a06111fda227a681663c3613eaa0a6f71d83b9b9751a8365ac433b9b39b31c00d24836217da3c49f4996119b2
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9vn:A3kMhT1LljG
TLSH
T1F625AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 951KB
SHA256 43a8277d41bd8659084d1c38793fd1716decf7cce329a3d7648f096affe19e86
MD5 a544390b70a28f6b8ebfddceb4c26281
SHA1 5e6876f4e612fba4c4fed6d3ba292b48a8dc40b1
SHA512 017a328db24a3fe9feaaa73519c01956fb2ad3f07fe65c35c2576ee42a85e2656f6f95e932a93997b404774c58d6f29b6908f6520185e3fb0c30cef2712c61ab
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9bx:A3kMhT1Lljc
TLSH
T1C725AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 951KB
SHA256 002da54905f389d3e3b6b71367653964871c980207e0f4929cc8e450b568365b
MD5 db135240b6bbbaa2f0d6fbd60ab379e9
SHA1 45847cf81109a2dde0f8a187b106e22275e0b785
SHA512 8c037ecf0c6322d846541947ef45a5660d126f16186971097ffac2dd26d77208581f3b52c19e95604237d3118aec91c594bf74d82927392c843d65647c99754c
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9JA:A3kMhT1Lljn
TLSH
T18125AE17E79014F9E8178134C9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 951KB
SHA256 6d63e9f0883c18802aa297db9c88da29994e623b06d475fa8e167499ed7a3a70
MD5 a7fa1fa71f8428b5b7679407f407cfeb
SHA1 dc5e07530aa0b960917651322a58e812f1a97cb4
SHA512 e5976828bc82762288fa28d27d475b269ccae87ec9f76afd6b602926a8b418b531fb426d566f9324ce4d1cb4b0f4020c9c4f0c8288c68a6ae5ab969178155f12
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9C9Q:A3kMhT1LljK
TLSH
T14725AE17E79004F9E8178134D9A54A22EBB1BC661760C7DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 951KB
SHA256 d7307655ec98a4e5b5b6c90a24feef79c21804c527d7a5e92599155118807e46
MD5 fbad0e07f2ef0a86267aa4f2d6ef6813
SHA1 5892165660a6d6993b0e9e23d314f3c5196bd98f
SHA512 bb2141ab7f292cb7247b0d38d03c8cfacd54d66f5fb440333b22c5364154e83bc5345f1b8f4ea1036202e78ab4433723e0285a58b66e705dd912237a797e2cf6
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9n4:A3kMhT1LljJ
TLSH
T1B425AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 951KB
SHA256 08b687c3d09be1cadbef9346a1fba16aa3a43d52cfd019d6f37d5b058ecb3cc1
MD5 5500c307603ff3cfa1879b873897c99a
SHA1 ae8dee56c5da498268dfddd30ffdcb9bd7353965
SHA512 91b1260b391e9d561942d25e802b21cc8e10cf29eaf619175d5da73b84d967e1b168f7ee5f5fd432062d3b7cec05fc06c7406f3feac889b200ca5f22fe04e727
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9Gu:A3kMhT1LljU
TLSH
T14E25AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 951KB
SHA256 ee5fe952ef74149f8c407f58fc32835fe35a986457d205489df8e42ac092ea89
MD5 69e4f56740c3a4c96ed3e79f0e536474
SHA1 1c078493da2b6ebff114009a18822d63efcc966a
SHA512 f54fc8006c09176c8950b533246a5f24343e010cd3fd47f3613333b6ba9237898e43328239f65f20483c59cd9d7f165d4f8a8ce1819e9b3f7114a099f0d191e6
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS93j:A3kMhT1Llj2
TLSH
T1CA25AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 951KB
SHA256 b05b6b8e22d143bd6ce2f7de34a5a71fb5e01b25d288593c3985de2d9cb8b608
MD5 6aa2ab209cb32797fc55945fb5b01a27
SHA1 a22b95322092d27b08bd8fbf9f67b720f72456b1
SHA512 ae836d94bd9d8350df7a7c37da7994295f786f28822d4f688ddb80c93294f685507d4cf96c348eb30ec1cdcdf50b6b5f3bce9c4b530d5941043a837170c3d446
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9ig:A3kMhT1Llja
TLSH
T1D725AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 951KB
SHA256 29b8513acf75287fc6f8e62d101a2fb0b7c8e53715558790b25147a34cb77257
MD5 ceae90f2a6bc4b066c1070c918fec19b
SHA1 b9babcf9ddb23661660e31564521cea09754b961
SHA512 da06a91f3e5ec6597b079dd781007b2e899e32151b5f514e8e6aaa5e455cb7d40a0319e619e9f8ac5c41db766c9ed6be55a76c66b4c25f06856245e910e2ed04
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9dI:A3kMhT1Lljb
TLSH
T1F025AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 951KB
SHA256 02df5aad5771ac9fc8bdf069630fe6e2cec74f93e6dead7798d516244c50d0a4
MD5 1ca5983ebf2f7d1d5ee7223ad49cc6af
SHA1 eb076944ded3451287c5aeff1aa5cbe552f0e8f9
SHA512 c79877713fdf276bb3778cd68756714a42ff7717d56cded04ee1a84646d3b0d6e5404c83ff250afe9275795b52534a3fbe9bfa1e9015743bdaacef6ccb096923
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9Po:A3kMhT1Lljl
TLSH
T10A25AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 951KB
SHA256 48f0fb73c74141aa3ca58c2b973d13ecb8c9e1a08ccae9abbad4484172890b5d
MD5 376c1b7624adf8c73f16f13d54753b6b
SHA1 02eedc9180b0bd5ebdc015fe48e2e4c818040b3f
SHA512 1c40e6143d3b5be728da93ffb19b79d75c1b378b63a6674e2fa0acd9937e4473c271b49fb3c89c4d61ced7988eaa673226ef1133be7d8203bd414d330da74629
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9U+:A3kMhT1Lljg
TLSH
T12B25AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 951KB
SHA256 225c632478c4c58a9f567c29f84b7b5af65d150f30c0249464b50bda01e26105
MD5 3a9e60c4c695e64289cd8f31690c8321
SHA1 ac789334e62c247077399a3aae6ab6181a6b8c1c
SHA512 33f2aa245cccc32596d7d63584568a50ba1da6c4999edefb9ba5fca374422ddee9dacf37c1ef106f197e3b11fe1b86f94bdfaf8a82097bab8c4fc32ce80a2b34
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9cQ:A3kMhT1Lljw
TLSH
T1DE25AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 951KB
SHA256 0f08b433f3966542bea634ef570d7aacd99ca9f933c4bc08b031b90711881fb6
MD5 4ac2e967a469852ca2bfe8584338bf45
SHA1 e0acf65c112d9d50a0dae7482b37fbb8c77926d4
SHA512 d0ea8c62fd3e30c6710b87a1203e0c9553ccb742d16519c368fa06651ea7a48b5760a44dd273e7622584ee3ab27ed87929a927ec7e327916b9d39eaad2f248a6
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9FX:A3kMhT1LljA
TLSH
T17525AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 951KB
SHA256 d637192547cf698d037049421bb8f1b969f74c2b0c14c1572236dd0434a676cb
MD5 88db8404807c4067cd9e7cf084388cc5
SHA1 32483f2fcb8125810860ff2cde9c48485df291da
SHA512 89a02dc7ebcf74eb41dd7c3c4feff7e7a0711add764fc90232050959777cacf12f352c59f6a735430fe8945613dd00ed38553e16d8e99cb40096d3d032dd707c
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9nL:A3kMhT1Llji
TLSH
T11325AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 951KB
SHA256 6aca7d22b6126852180b5f0cc058264436735ac38c2b7e829f390e26f29269b2
MD5 886a3724cfea6f684ea18557268ac0dd
SHA1 d74cfee004f52eaab91d6caf86a8b8a565de54b5
SHA512 3f11c644986b27ac79cbc13750ef4545f113364ba5b023fbfa82ae0b5ca8cfbf25710550e12b68da5a22fa948b1424725fd94ba941afb64bee2e88a8b9715278
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9dM:A3kMhT1Lljv
TLSH
T1DA25AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 951KB
SHA256 5f3a9a6e36b4552a72793956d0161e7c8b0707be6ebe3be5c7ffa0d6c437673b
MD5 9097c7972324d811a0137c47daf12e94
SHA1 50176599d59f2ca4e8308bf04a03b4671f3a99b2
SHA512 a4c73f8935faa95d17601d11b1d2bb1119d2e6e657f34293581b6d854aa975ad9065226cc2ffe2f6c9234b839495b906ee7d67df2b3d4e5a14218ef6870b636f
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7YS9Oh:A3kMhT1Lljh
TLSH
T13225AE17E79004F9E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4144-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4144-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4348-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads