855d3d8d7ee00fe844d82a0be91965626336855d3d980f62d2a9511d17109779

Analysis

max time kernel
103s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 2.4MB
Sample260811-qmch6stepd
SHA256 855d3d8d7ee00fe844d82a0be91965626336855d3d980f62d2a9511d17109779
MD5 ec01038b6e73b02e5183238a3658a719
SHA1 e7dc855e5f2d5dd47a1c36239ad710e83255f398
SHA512 a7a22b2f9dbe6510d02c69b8e53ff7a7f61ee8dea023b064041e7767935b6bb63e6f04a536821fd43635f7ae161e911d569bd6b8c3f0e7226117551f3cd8f395
SSDEEP 24576:A3mnXoZjzyacNVOE/Z7aTWaLl3z0zDj5jcAkSYqyEj8yyCUq7lfHLzZe0p4Ek4nQ:A3kMdT1LljApYqgTebeW4SkZP4sz9Mb
TLSH
T15DB54B16F6788772D073C0B9C5D6AA5AFA7234461B308ACB0349D32C2F277D19A3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 9 IoCs

resource	yara_rule
behavioral2/memory/5772-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c51e-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001b2cd-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5772-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5092-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001997f-537.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000019ae3-746.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001200000001891f-1525.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c542-2114.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c51e-5.dat	aspack_v212_v242
behavioral2/files/0x000400000001b2cd-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001997f-537.dat	aspack_v212_v242
behavioral2/files/0x0015000000019ae3-746.dat	aspack_v212_v242
behavioral2/files/0x001200000001891f-1525.dat	aspack_v212_v242
behavioral2/files/0x000c00000001c542-2114.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5092	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe

Drops file in Windows directory 29 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5772	2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5092	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_ec01038b6e73b02e5183238a3658a719_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5772

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 2.4MB
SHA256 855d3d8d7ee00fe844d82a0be91965626336855d3d980f62d2a9511d17109779
MD5 ec01038b6e73b02e5183238a3658a719
SHA1 e7dc855e5f2d5dd47a1c36239ad710e83255f398
SHA512 a7a22b2f9dbe6510d02c69b8e53ff7a7f61ee8dea023b064041e7767935b6bb63e6f04a536821fd43635f7ae161e911d569bd6b8c3f0e7226117551f3cd8f395
SSDEEP 24576:A3mnXoZjzyacNVOE/Z7aTWaLl3z0zDj5jcAkSYqyEj8yyCUq7lfHLzZe0p4Ek4nQ:A3kMdT1LljApYqgTebeW4SkZP4sz9Mb
TLSH
T15DB54B16F6788772D073C0B9C5D6AA5AFA7234461B308ACB0349D32C2F277D19A3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe$

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$
Size 2.6MB
SHA256 faaa66406c5be455e84b735be35747dcfa0485f85838ffe010869a1884ad1321
MD5 aca5cb286a132ed967297eb0b1d1e844
SHA1 5ce86b1b11b9a055c63800bb22cef81b939ad1cc
SHA512 8f4289c7b4d4f7b1ad33edfe3c194ce78981339e093b9f3b451b8618870cc027dd6f3cc3d9b9cd2fe609d44fbae8851cb7f60bfd11628039b917246015e81c61
SSDEEP 49152:A3kMdT1LljApYqgTebeW4SkZP4sz9Mb6T1Llje:A3kM7LtA6NTofkZcGLte
TLSH
T12BD55B16F67887B2D073C079C5D6AA5AFA7234460B308ACF0359D3292F277D19A3A735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 2.9MB
SHA256 2aadc099ff21573184d301df0b115576928b04f9d7615d76901c455cafc9b297
MD5 3ac8bb3b1b95d0ade5b62c07ab435ef1
SHA1 dcbab303b1d476cf1420fa331c1ebf6cd771abe2
SHA512 32d1ec856be74bae7b21ac0ee7a8c3ed567379e83864c654f2ba47b028a88c0714055d844d286640fb637e522e9de03b929ac4447d35e1ef2b513bbcbbeae3c3
SSDEEP 49152:A3kMdT1LljApYqgTebeW4SkZP4sz9MbBPji0Aj:A3kM7LtA6NTofkZcRjo
TLSH
T1C4E53B16F6788372D073C0B9C5D2AA9AFA72344617308ACB0345D76C2F277D69A3A735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
Size 2.4MB
SHA256 560c1c91c2777f6e7d0b585d8b9aa19915e73c28ef272cf60fd9830cce2aa485
MD5 64cdeb37d60c82b20b281806f78d8b18
SHA1 83676ddf53f96dd067028ed7e86bbc18a039e979
SHA512 ace745a4d2ec7aa59ae4b5c36d412da9576a62001f876a9af70cbd6d18487a239d2e6dfa164310e63ed51cd99afa4bfe77f71b7569a02066306a2d0c50c5e133
SSDEEP 24576:A3mnXoZjzyacNVOE/Z7aTWaLl3z0zDj5jcAkSYqyEj8yyCUq7lfHLzZe0p4Ek4nh:A3kMdT1LljApYqgTebeW4SkZP4sz9Mbz
TLSH
T139C54B16F6788772D073C0B9C5D6AA5AFA7234461B308ACB0349D32C2F277D19A3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integrator.exe$

Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
Size 2.9MB
SHA256 9fa3e9a52be429d3cc3d61d8993ae19afb092eec4e208a3a60ea1c4d9079d5aa
MD5 c029b6cd3d69bd0ddcc91e0b04d0c688
SHA1 f6cc082ebf2443205bcd176132c75a2dfee8939a
SHA512 f91d0e8d75ec8d020d7dfdaa322a165f7ccb2e4acb4e26aa441771ecefbe7c4a93c94c749951986780aab797c4e8d897bb1a05e938779c5b005cffce49ddfa36
SSDEEP 49152:A3kMdT1LljApYqgTebeW4SkZP4sz9Mb9UOlk09:A3kM7LtA6NTofkZcn9
TLSH
T1F4D55B16F67886B2D073C079C5D2AA5AFA7234460B308ACB1359D32D2F277D19E39B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationFontCache.exe

Path C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
Size 2.4MB
SHA256 243c1e9c901fe9c96665b25362d2c89ceed883942c693f6eafdad4ed1b2011c2
MD5 077edb33f1ddfa97d35ff5f622eb14b6
SHA1 20120e49137ba16155044870652449d1695d7f5f
SHA512 9f823702f3542ac9359edb7300219dceeb3d0e19499e45235b7e04efb087c91b1e4386738edee8540f9adb099121b26f95ad8813f8e8b71b000609431b0c86f9
SSDEEP 24576:A3mnXoZjzyacNVOE/Z7aTWaLl3z0zDj5jcAkSYqyEj8yyCUq7lfHLzZe0p4Ek4nF:A3kMdT1LljApYqgTebeW4SkZP4sz9Mbb
TLSH
T182C54B16F6788772D073C0B9C5D6AA5AFA7234461B308ACB0349D32D2F277D19A3A735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5092-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5772-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5772-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads