491c63444b6f94f358698215dbf48bd65b1dd46cd7da1b0d29ff5ff9734af4f2

Analysis

max time kernel
102s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 17:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_f0ac88f8b1c2ffde5c33799442e9447e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 890KB
Sample260810-vj6p3adn2x
SHA256 491c63444b6f94f358698215dbf48bd65b1dd46cd7da1b0d29ff5ff9734af4f2
MD5 f0ac88f8b1c2ffde5c33799442e9447e
SHA1 099884a452a00bc1aead5236bd3fc040a0a00b94
SHA512 0e3240ab3842d4a238c744518664259a26b06700e024b4ff6eba67f38f91cce1c89c2b4ad07f6c7c7b7934272b8f9a25ad0cf7ef6da750b2353eed8cfa911438
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaF:A3kM43NCLTL
TLSH
T11115AE13E7A008F5E9178134D9954A23EBB1BC661760C6DF236892252F737D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/2692-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5b3-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2692-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6048-41-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-540.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-607.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-638.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-743.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-799.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-912.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1044.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1081.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1130.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1322.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1342.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1367.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5b3-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-40.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-222.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-261.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-442.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-540.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-607.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-638.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-723.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-743.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-799.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-854.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-873.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-886.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-893.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-912.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-931.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-950.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1006.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1044.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1081.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1130.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1149.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1174.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1181.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1218.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1322.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1342.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1367.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1374.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1387.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
6048	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-10_f0ac88f8b1c2ffde5c33799442e9447e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_f0ac88f8b1c2ffde5c33799442e9447e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-10_f0ac88f8b1c2ffde5c33799442e9447e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	2026-08-10_f0ac88f8b1c2ffde5c33799442e9447e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-10_f0ac88f8b1c2ffde5c33799442e9447e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-08-10_f0ac88f8b1c2ffde5c33799442e9447e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-08-10_f0ac88f8b1c2ffde5c33799442e9447e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-10_f0ac88f8b1c2ffde5c33799442e9447e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-08-10_f0ac88f8b1c2ffde5c33799442e9447e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_f0ac88f8b1c2ffde5c33799442e9447e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_f0ac88f8b1c2ffde5c33799442e9447e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2692	2026-08-10_f0ac88f8b1c2ffde5c33799442e9447e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
6048	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_f0ac88f8b1c2ffde5c33799442e9447e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_f0ac88f8b1c2ffde5c33799442e9447e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2692

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 890KB
SHA256 491c63444b6f94f358698215dbf48bd65b1dd46cd7da1b0d29ff5ff9734af4f2
MD5 f0ac88f8b1c2ffde5c33799442e9447e
SHA1 099884a452a00bc1aead5236bd3fc040a0a00b94
SHA512 0e3240ab3842d4a238c744518664259a26b06700e024b4ff6eba67f38f91cce1c89c2b4ad07f6c7c7b7934272b8f9a25ad0cf7ef6da750b2353eed8cfa911438
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaF:A3kM43NCLTL
TLSH
T11115AE13E7A008F5E9178134D9954A23EBB1BC661760C6DF236892252F737D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 a37f3ebb89d9f05e8c5c43f5ecc8b3fbaeb4634975d660ef05bc07a45bc58c05
MD5 f7825dd0440ae50673be0ef61b2c40c7
SHA1 769bde0ed128888e7b9a7fce6de4cdad58182b51
SHA512 a25857da81e0a4f1a2f396379364ef607e31dbbc3b22737be219d9e0883ff40f0faa0b0456e852e2a1576d4c5c9ab1244b8bbda480580c9bd9ac368a8b924bba
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaB0Le5ji0hmxNrM:A3kM43NCLT3Pji0Aj
TLSH
T1D2658D16F6B446B5D073C079C9D29A5AEA7138421B30CACF1399D7282F337E19A3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 904KB
SHA256 8fb104553d79163de6657ab7ab9321295f00cd95930f861ada3b85d1faec4fc8
MD5 da368f1ee06f43335e123aca920ce146
SHA1 d9b7c40ef2975445c85d6fc3b21ea3bf3d63efce
SHA512 da3857dbd7a270982fb0a6e0364c1112ef62f1004982c9047e88a753940c497d9fd8129ad126b42b0752241054f0109e94fef1d512501d47f8e5f92b625c3007
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaDa:A3kM43NCLT
TLSH
T19515AE13E7A004F5E9178234D9A54A23EBB1BC261760C6DF236892252F737D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 913KB
SHA256 11d7c1e6304ff33e154463b2b8643fd703828c373bf80f371b91c4e603fd2a15
MD5 14f1727920c5461a6a936dd06c80b3d6
SHA1 47ac660db5c2590bde5037963c79031d2f3cc303
SHA512 47d8fc0fbbae85ebdd4caf5206e79eee498cd4731ce73ca50c7e998af154d557a730eddad0afc6b1abeb9b8ad120298dc326b411d53a310fac1f2de13f1f6a85
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCai6:A3kM43NCLT/
TLSH
T17C15AE13E7A008F5E9178134D9954A22EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 913KB
SHA256 513b17627602e81892fae5f9059ff290178184594100c707be774274b823f34e
MD5 8732319f1af818b78e98fd66202f9e85
SHA1 6c60981878255926b47280fd81706d773dd17672
SHA512 0b0a7d2d04f62981c840d9abdd632dc186bfea339699a5fc18b80278e89cf8d6965922ba867126eec113c68bebc4e40ed0fd129993268039792557d2da3852f4
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCa6N:A3kM43NCLTi
TLSH
T10C15AE13E7A008F5E9178134D9954A22EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 913KB
SHA256 1a274e6a776a48683c7c85a4791bcf76da1c80bb859d4895afb923ed865243a4
MD5 0914419a90ec710fb84af0a38fd107fb
SHA1 cd8b80483c373e57a976769e9b817a8e88ed2fa4
SHA512 be56d0ebcb137524a13ad09561cc000fc9da69c19696151381f12955c97848478bddf733dad4601be3b3ec583aa8cac650eec92dd3b00cb3b8d67a1d01e2401a
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCagf:A3kM43NCLTe
TLSH
T1E115AE13E7A008F5E9178134D9954A22EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 913KB
SHA256 6caaf8aa6bd8f169b04d415d0c50a587a282243e3662e49dede183e74e637865
MD5 3bb0275b4635674e164d4ecb3648004a
SHA1 6ee9e275da04e1a6a733b8956298648d05774d51
SHA512 e878218cb062e5b99f4102b7e90cd04051090ea11bc1476daf56a05f16a1054848ce55fb1afed935319d961e98f31916328320ef8b065c8ded1e3d7fbc825a5e
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCa6o:A3kM43NCLT/
TLSH
T18915AE13E7A008F5E9178134D9954A22EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 913KB
SHA256 aca549dfecd50fc162e917387c99acccff430fdf52b34cecf87ea0f71f692dc5
MD5 3a054adb1568ec3a7332cd657e6be157
SHA1 87d65c02075c425a4414f1ff0ffe36cc9b2842c7
SHA512 567781c41c7dbc618496bc6a4a95f967fb8db9bcc980517917da53aaebe5b38540aa00eac4ff2807143f55b4274962eb2fc1bf658599d42a9b79a8d8322f5798
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaOu:A3kM43NCLTR
TLSH
T1E615AE13E7A008F5E9178134D9954A22EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 913KB
SHA256 36a883937fe36b026387bb82fee9751b09d7dbd88d58d3831a93d8e2dc30cb96
MD5 f6c733e13bade33af52585f7cb64ceac
SHA1 8632867cb0465df17d14cfb0d5351a4ebf82317e
SHA512 ba621836df93170f001d3553d751463165216a39350fefd2a49d0b1979b421020f488e6863acf53ca3815d15492c79df38352d781eb248d349ffa76e984a3d5f
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaC9:A3kM43NCLTs
TLSH
T1C715AE13E7A008F5E9178134D9954A23EBB1BC661760C6DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 913KB
SHA256 f9e35bf74fcd644a8ccf4f9be69b2f44acfaf9c7607edbcdb4f19d7d4e8e45e9
MD5 558c7d4840d16416dc5048073f1c033e
SHA1 77f69115e38a0cd77545b83f83b05ab0c458760e
SHA512 799717821cf16aef2da19dca4e570f106086135e09d2a91f12443b74e2f335bb1700e83be47ac61057e3c94c6f1d01203361b7c127baf4a9f8e0d7196979c0b3
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaCc:A3kM43NCLTl
TLSH
T10615AE13E7A008F5E9178134D9954A22EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 913KB
SHA256 d44c31ffd19ee8be2e810e7aad95b98c43037942d1bd0bff1a56a0f343bf83ba
MD5 0cd6478f905f059f71009c4700a51828
SHA1 0dfa575a43f8db9848185eb624ccfa323327057e
SHA512 50bb84b590dd315aa112d5450bd46ee8594839d8100815c3e10ab871840aca5dee4a2b31e2b8ea097c39bc84c7ced34554019f5c2fe1b7612fddd43d794ac28a
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaLp:A3kM43NCLTL
TLSH
T11515AF13E7A008F5E9168134D9954A23EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 913KB
SHA256 533e2c0524fca4770c31ee91fdd9aac8e075e0d699f59379bd3d300368af2851
MD5 b8801ca0b30383db4b99928eae69e778
SHA1 ea12eed085a29f2e2cfbb43f836cb28eed2ed0f9
SHA512 4213faf3ead82e68e15b647aa42b7983b85d5567043028ad606f049cd30acaf5e44a94e6b08e7f8ac687c00f2131f0daf2f05bfb7243e61ca99c0849edbc5e45
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCacN:A3kM43NCLTw
TLSH
T1C815AE13E7A008F5E9168134D9954A23EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 913KB
SHA256 2c9b722ec5a88f46f3add7f2f5c7bfe6c113181866ab4c4ead479af11de40916
MD5 3436d3d5dfba43d4941e608393297e3b
SHA1 69562d368e743f85399ff38f942b51503b4b5baa
SHA512 733e492c644be1d081f4eb9ca6df244e9511baf55e98bb8012346a34ac7e7ddaabdbe122dd4fca0fb01e2a97363406770dac5095590f9e5429aecace5451465d
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaEF:A3kM43NCLTm
TLSH
T13115AE13E7A008F5E9178134D9954A23EBB1BC661760C6DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 913KB
SHA256 4b2095a7c18fed3cdd6101cebad474ca1883d88b8e656454a7dcd100c11e7bb3
MD5 73c7034fd8805b6c8e22a5949cf1aedb
SHA1 a5bef76de6504e54875fe530c77b14918c3da8fe
SHA512 c0c67a96b91d64098d34c2d2d15106e06624231aa82d7ed1b76a36649a81c655ed5725ae283b499f13f91fa9e4e003c02ef27188be1ee6481cc513d6d67d37dc
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCahC:A3kM43NCLTi
TLSH
T10A15AE13E7A008F5E9178134D9954A22EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 913KB
SHA256 2b7791e0658481e234bac38a4a97cbd5b73d9d200983ad5638a700b44fe27b53
MD5 3fda8df05a6fa20059347223828aa353
SHA1 5bb9c6c6dd1ef361c4bf76279233cae941f036aa
SHA512 f675673c8964e1ef5bb0b2572e20e92221d30abeab6a16aac567eb6d4569f56f5326a7a7e1e51fe4867f1740d91cc956ff4adf2a17c3f729876644b83855c854
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaiw:A3kM43NCLT3
TLSH
T13715AE13E7A008F5E9178134D9954A23EBB1BC661760C6DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 913KB
SHA256 9bca7c370018909045b48d953ad39a1a7754022c7aef345751a163ffc4cf09d3
MD5 0955b3c94184ba021ee58e9a347f145a
SHA1 94341e29bb4b8f34bca6bd7c09937b2de53f84b8
SHA512 616573accbd6cd310a25a68a53e3378f08f4e0a58536f74b7a4c89e758791b0bf74d724c7bb3eee98866548de856010eaa2a27bfdf277b88c04a3ea3f722a3ce
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCapT:A3kM43NCLTz
TLSH
T18E15AE13E7A008F5E9178134D9954A22EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 913KB
SHA256 b2788596a66a35cfc1efa82af4f98af08191966ce4db8bb1b0d3acfa5839442e
MD5 163a691c30c7be2e51171be8f354448b
SHA1 ddb877e7dae4f0ed6029c063537198bcdaf3bdd6
SHA512 a0b32cc98e78f25a2adf6930d7732690a7df89bac37228ece353b93b568ae31074cc6e955431b877273853cd1dd5d8961d1e26b08645da72aeb678d1a4a908ef
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaHu:A3kM43NCLTk
TLSH
T15015AE13E7A008F5E9178134D9954A23EBB1BC661760C6DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 913KB
SHA256 d09aaa9bcb865055bd3a4574a454aecf64a58ef51c8fc83d2758d033d0937516
MD5 71a26a9653c0dffeb633487092328b35
SHA1 599b3c349ace636a63c748ec4079b6f60d5f489d
SHA512 1127fb71814ffda096b70529ffe08fbf69f2c2690ae0210bdd24a8013cbd31874a6e07bc664d62b3da4f6cb4172b98c53b50aace85c2e56ced5b93f4dba44cf8
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCabb:A3kM43NCLTN
TLSH
T11715AE13E7A008F5E9178134D9954A23EBB1BC661760C6DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 913KB
SHA256 ade481b22b7c0348604b6290a717deb7c426d36724f070213ec35ca0c03f344e
MD5 a4da4a1363a26b3b8666eafd810b480a
SHA1 335933b37ab0735c9c9590b368be824532a88824
SHA512 819c455ada28aa13ed1c6d3bfa42a7b7f8d79d96b0f522270d7e17cc146441d611fb246f7102625db169a34742bac9ca20ba64bf9eac26d1da2572dce9d64331
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCavf:A3kM43NCLT9
TLSH
T13D15AE13E7A008F5E9168134D9954A23EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 913KB
SHA256 3d65e4b54e2e4797ab38651edcf6048d273dcfbdcab5ae4e8466cb285dfcff0c
MD5 31f8f15a3adc92cc6eb8e591ae70f144
SHA1 80733792d1988ec53fc9ae888349bc2fef500dac
SHA512 cb866ed17e975d9726d7382b80850b7962e7db41a5fe2e643ffc5f85d0834168b405d6feb4fff816c679cdb126e85dd1976ea051dc4ee961fa5c9577c6bbac99
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCa4K:A3kM43NCLT1
TLSH
T11C15AE13E7A008F5E9178134D9954A22EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 913KB
SHA256 1fce699e04f92cc9e2952363eb6f19de9febe84c42d179cb1afdf67e0c4f8940
MD5 22831a2e16ec35d9c82ad9da06bf36a0
SHA1 a09ba553bc6960ce84ad8077ac05edff532b1c21
SHA512 de700f3aa0a24c17a71f3b6f8739083a0800d912b3f98001a4eb16c2bb41871343f24b81edf708e48e382da4a59f33282a66b43307037827e9d2a36f651a957e
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCalk:A3kM43NCLTc
TLSH
T15F15AE13E7A008F5E9178134D9954A23EBB1BC661760C6DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 913KB
SHA256 45c9d5b4344826a50c6985736eb2c034f9a33511e65a6c2a7345247627a925c5
MD5 86b06bdbeb3a621fae5552851bc402fb
SHA1 afbd8ef320d6955bb184f757d1fe861e1098be32
SHA512 f9f1a322947820a170048dc90bcb2525dc2c324cab9faecf3dbe9ac36ffaaa2314399d1fa22f9d069a9afa2476a825c5c8548f69fb5fbd5cfd8a0fb76c25e03d
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCa60:A3kM43NCLTV
TLSH
T17A15AE13E7A008F5E9178134D9954A22EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 913KB
SHA256 d8afecb1f0aff23d568e0020ce9ec8ced9d830ef156afa235d75d06dc01441de
MD5 4f7b42579baede75eecf6b74a903a20d
SHA1 571277a3dfe29c609217f294b7aa0b17d9e37d77
SHA512 a1bdec87f3f41541a584d1b40cca28d9dee69a907ac661e73a07644c76c69314affe00b17353285e1bc709a6cfefceed2c8a1e61f3c06b83acc4a6b3a572af83
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCapg:A3kM43NCLTU
TLSH
T14F15AE13E7A008F5E9178134D9954A22EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 913KB
SHA256 16e8d503cc5ebe2029c1d2b217592d2aaaebb8019eb84a2a9f73d59df76b5c2d
MD5 8948c85833c1271c961fb2f5b630158f
SHA1 919df1ca724212c87238779dd5ea62cb1cc2cab2
SHA512 44dc6ba1fe66045b5e42a77a14df245254afcd3bd158c8a8c45aa0e2f8a8f592d9b93e8e478876e771b37bde490cdb4bfeb9351cc1d1219c210e9e103c960c0b
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaQr:A3kM43NCLTm
TLSH
T17815AE13E7A008F5E9178134D9954A23EBB1BC661760C6DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 913KB
SHA256 e7315f38b4cd60baa8407925ddd03fe68fd8bfad81b0032f90c0226c4c5ad0a6
MD5 eca1773b3815b5beb4bf5a2bba0e40c9
SHA1 d5a23f234dd7e3eaa20cb5389d17bf9cc6766a3b
SHA512 a370b68b51e50c309701132985c1b566835accd70fe1e739016412dc8fe137a695f3cdb979d30fc6fd48aebf994eac0b942d5480a34fee8f54749500cda14961
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaOn:A3kM43NCLTA
TLSH
T1C815AE13E7A008F5E9178134D9954A23EBB1BC661760C6DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 913KB
SHA256 bb6bcdda2012da057d4f207f9f73666aa87fdec7062e3ba584b3b8f3403ab538
MD5 c6414875218ce86f72de076d9c9d6e38
SHA1 cf00a32f76c9d9506b93e75842a48b08b173a9e1
SHA512 3df85a1b9ec00709125a88fa024c72c7efeec8ba5016fc01b4394f1857d317b42b954e7b9c7e26e61c25a2cb2ad074859317053cf18c974d0782800db3431085
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaEx:A3kM43NCLTG
TLSH
T11215AE13E7A008F5E9178134D9954A23EBB1BC661760C6DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 913KB
SHA256 89a44759f0f644ebad6f723604a020104b0fb502ec46cf1e639beb684336a997
MD5 5d63106f9dfff4f3b92207b645757d88
SHA1 f5a6976b725034561f4477d06246dc94bea5814a
SHA512 c3328cde39bd43b7b64470c3f457bda28c95261c651f988b8212c06a763792094e50d6a7a09bcea6044a628c4a30a0bdcaf53ba5d908f77c65bc039d5ba4e6c0
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaOA:A3kM43NCLT9
TLSH
T11A15AE13E7A008F5E9178134D9954A23EBB1BC661760C6DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 913KB
SHA256 e5678fcd00b85c52642309d3e7990a27b8400b20a75b72733943f6d6c5d79398
MD5 e4579e6067d63431dc49c114de11652b
SHA1 0c6e35abec102bd83b7a2bc6e91ef3fb5d0e2dfd
SHA512 af16083eadfdc62940c41a1dfb728b2910d14f819ad3daf7e1e3f42b5800bf0c74a97753d0ca0b4fabdd6fd8d096653a6d0d5c2c9df5ba444d9d6a096d0d3b3e
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaH9Q:A3kM43NCLTs
TLSH
T11F15AE13E7A008F5E9168134D9954A23EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 913KB
SHA256 02bebdf7c49745f051e73a03e0839923f43729301db696f57f1e1011a4503dff
MD5 c0491fd3c322706ca1fc8643dcc96030
SHA1 f89c968b36135e9205c53fb57c734ae2337ad63f
SHA512 4a1963b4aed7bfbe64497295a53c43849030bc3daa17b0e1161f0f91911d09a75d02be0bb05e5afc176459bf67a0d67ec2ebf72e33f1e66429e7e21482980adc
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaO4:A3kM43NCLTn
TLSH
T10415AE13E7A008F5E9168134D9954A23EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 913KB
SHA256 650150590600841966e7e8f113d8e8de2da0e10736069d9bac4d14c91d509dae
MD5 3ac515883042fd8c3baa827b87359417
SHA1 ae3fe3fbc727bd1e7126f38b2d2cc9474675e0b9
SHA512 631407060c65c51238ebb75df6b3d2097e0ae09e4ecd0b79c1b80af26038f9a1f5b7594a558b423f90046e0c242fda06ab4be6c41c0d19d81a16bd5c848aa531
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCatu:A3kM43NCLTq
TLSH
T12215AE13E7A008F5E9178134D9954A23EBB1BC661760C6DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 913KB
SHA256 2feebc1c0f8e8ba2232f9dea6874418f9d73aa099aa13db1991f05b0fd255cd1
MD5 d8d4adfce693099033bb67fa37996cba
SHA1 6684be8af5cb84da749967a02527f11eb2a1f6a9
SHA512 151473c1772d3515f88c4ae76454442c92d0ac37452440cdb76776e02d8951600a7ddf9ea9f8a3c1aeb838caad1aac01c67a914645416e0b8c8247351e4d2111
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCagj:A3kM43NCLTk
TLSH
T17615AE13E7A008F5E9168134D9954A23EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 913KB
SHA256 2c67d98b215b334c4548846021394149d2e8f0d9fa0dac1554ef180fc1159243
MD5 f808e871d2158b3ba9d409df7a82c5b0
SHA1 a0aa288a9979b98b3f6cdada40af4defff190530
SHA512 245e2c2eebb7e9e6b67c12879602efbe250a6aa1ebe1fc1cba3dfc9aa01ee54baf4d65128833f50b7186565cb0817eb407a56b9516f32ceb33e722c9780786f1
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaRg:A3kM43NCLTs
TLSH
T1BE15AE13E7A008F5E9168134D9954A23EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 913KB
SHA256 674dd81ac90474a7a455182ad1bcb07d0cd4bd2e04750312dcfb7d57f2dd9465
MD5 5f4f83f343fff8e8d313eea4a977d396
SHA1 79d37da70a5251249d92068972ae6f67a787716d
SHA512 7a4b6437acc807dc2b5f00980305a07f74d15965187af28a297a1ffbc790981e21b7402e8a18a46cf647947bacd730782dcd6fc116ce1c4da1134fb4638ac55e
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaII:A3kM43NCLTl
TLSH
T1E115AE13E7A008F5E9178134D9954A23EBB1BC661760C6DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 913KB
SHA256 12fcb03d8eb0921de243d4b758c764de8665cbdb9af02d0a6dc7ed01371e4eb2
MD5 5707895c4b4412a78e970d31caf6257b
SHA1 a1e1cfa6ddbf7fc5b84c1b039c8f248d8b2a009b
SHA512 5759a78434a30654a01b8bd3833431c484cd8758fd9c8159867b4541ec4115fbdd038daba2a4ff5796dbbc87c3a019dec5baf5f57e19a305329cb17cacc21216
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaqo:A3kM43NCLTT
TLSH
T13D15AE13E7A008F5E9178134D9954A22EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 913KB
SHA256 fb80eaa6f99108f5a292370b8570df732597d966ed5e2cd20a06bca38e941134
MD5 f5af84ca4f326a3e4b9ea5b3df4a772f
SHA1 467073d3869547278e4ec92e304549790a0afb35
SHA512 4c2465c3a5da95aebe054d895baad0a1972453fdc95bba64a7bddbec4a54580606e175293f4931bbbb75f145ac24ceb33b40cd9e0b15e5511926c6e24ac83945
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaB+:A3kM43NCLT2
TLSH
T19215AE13E7A008F5E9178134D9954A23EBB1BC661760C6DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 913KB
SHA256 6d9c396fef800336024d9375df7284db5634b7e680c1a055d1d0329d8bd08352
MD5 d0e13f0615d4a9d54bf4504520628db0
SHA1 e68ebf451d53a00e06a094e3c3fd17eaa69755e9
SHA512 02b33b9f1c92694dafebf9d98a576e9627b5c1b3bf295940c62d36d550b2fb553634942f35059827a4553192fb04a829f811b7d53c18dadbefc1372bce8d6319
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaPQ:A3kM43NCLTy
TLSH
T17D15AE13E7A008F5E9178134D9954A23EBB1BC661760C6DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 913KB
SHA256 8cb72e46a070a289410f93066a52ba7d941c9e2a4509652ae0011268a43a6ef9
MD5 65779d21b177530f664c301dd69dd765
SHA1 87cae01431222827453f56a5bb044eb1190e71a6
SHA512 319ebf9628c2e42c4a4b30efbd4b4a76eee44e5a641e5af9170c165c2067a7972f2b25ac2a8341e52ffcd1b0beb622e4edb855d41d3bdf101b5847b040985103
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaUX:A3kM43NCLTi
TLSH
T17315AE13E7A008F5E9178134D9954A22EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 913KB
SHA256 e7b0d59416076e6fa475907a13c72f488993a86fdde9eb105b15e7e9e91c1295
MD5 3482119970a9e707a83bd63938f41cd1
SHA1 ffcede7c8e1d65a29e5db2715379265cffbb0a82
SHA512 392dfe0b2f5c2bead1ec797dd28b8ce74ae398b7817ef1bc0fcd759cb4b8535222d79a5c5c904827f93ea6fe211939d20e10853f26b2369d1449771b656b1df5
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCayL:A3kM43NCLTM
TLSH
T1CE15AE13E7A008F5E9178134D9954A23EBB1BC661760C6DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 913KB
SHA256 9c610f76f00aba18f42fe38db15cf5e1f49070a81e3d3150e1649cb7db1842cb
MD5 9b906a4a0f4b4359a88977b69b8c45e6
SHA1 837f8b3e6abc5720746011f3964647500299d496
SHA512 ef93d7b6b035d56300cfd58c0ad266ea59cd6fe646fd114331bf8aad6e3b743001032ea084ea2757a8cc02bed46d2c7fde71732a740a9f6fe82c16a4d73c8f44
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCaWM:A3kM43NCLT9
TLSH
T18D15AE13E7A008F5E9178134D9954A22EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 913KB
SHA256 eb63cdb1fc59c46080174c7d82ecd47ef1d5b091b75583e530724ffcefa81b55
MD5 2e0d9e8bbc2c4682ca43020ae4b05819
SHA1 70b461b61be30faf95448679d3a3ad19ce9a1fae
SHA512 8ff48f5ce0105c862dfd6889a7019270d9ce5214113d18ffd8923446b2bab1c61536ee81a7dff8ede86c6e7968b729d67f8dfd8113122b7c5c0f2cf019b4ed0a
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7GoCafh:A3kM43NCLTX
TLSH
T12915AE13E7A008F5E9178134D9954A22EBB1BC661760C7DF236892252F737D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2692-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2692-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6048-41-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads