bfc2e316860e72dc81db5aff1dca53df7f823f31b646ece1e78c05d4b0e379ea

Analysis

max time kernel
106s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_dccfad140fccb27ca77603361c9724cf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 892KB
Sample260818-rs2wpaterg
SHA256 bfc2e316860e72dc81db5aff1dca53df7f823f31b646ece1e78c05d4b0e379ea
MD5 dccfad140fccb27ca77603361c9724cf
SHA1 560bd3f5e3288b70def798e6c50f48c40aac24cd
SHA512 916425dd4982b4f80baf8af77ae410b9bdbf949e33dfa16d3fb68d839eda4ee4fd88a2d7342d4944aff59e42352ec9062b8472771c673fc17448a40266849d68
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbp:A3k03kB56rQ
TLSH
T1EF156B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/6128-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5f9-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6128-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5732-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2fe-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000188ca-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-522.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-601.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-792.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-842.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-867.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-925.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-981.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1036.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1063.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1100.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1137.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1168.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1207.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1334.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1360.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5f9-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2fe-41.dat	aspack_v212_v242
behavioral2/files/0x00040000000188ca-222.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-260.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-491.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-522.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-601.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-626.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-723.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-792.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-842.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-867.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-925.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-981.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1036.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1063.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1100.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1137.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1168.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1207.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1321.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1334.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1360.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1374.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1381.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5732	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-18_dccfad140fccb27ca77603361c9724cf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-18_dccfad140fccb27ca77603361c9724cf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-08-18_dccfad140fccb27ca77603361c9724cf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-18_dccfad140fccb27ca77603361c9724cf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-08-18_dccfad140fccb27ca77603361c9724cf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-18_dccfad140fccb27ca77603361c9724cf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-18_dccfad140fccb27ca77603361c9724cf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-18_dccfad140fccb27ca77603361c9724cf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-18_dccfad140fccb27ca77603361c9724cf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-18_dccfad140fccb27ca77603361c9724cf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-18_dccfad140fccb27ca77603361c9724cf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_dccfad140fccb27ca77603361c9724cf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-18_dccfad140fccb27ca77603361c9724cf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6128	2026-08-18_dccfad140fccb27ca77603361c9724cf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5732	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-18_dccfad140fccb27ca77603361c9724cf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_dccfad140fccb27ca77603361c9724cf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6128

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 892KB
SHA256 bfc2e316860e72dc81db5aff1dca53df7f823f31b646ece1e78c05d4b0e379ea
MD5 dccfad140fccb27ca77603361c9724cf
SHA1 560bd3f5e3288b70def798e6c50f48c40aac24cd
SHA512 916425dd4982b4f80baf8af77ae410b9bdbf949e33dfa16d3fb68d839eda4ee4fd88a2d7342d4944aff59e42352ec9062b8472771c673fc17448a40266849d68
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbp:A3k03kB56rQ
TLSH
T1EF156B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 bf2c33c1630a53a3b6b7ab040a22bc3f76179c38f8d0d5702aec907267cdf12c
MD5 fc6e5a8846171c040904b74259e16c9b
SHA1 7c8a692411d4491bc2ea321339c204891456bfaa
SHA512 2bdd7059079dec45b8cca29d9427336eeb87fa2304e753cb7c5ef03f4573f85925eae0ba46f2686c509ea8a35f26a35b9ce595c28dc95dd102f1ae42908abc3f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbV0Le5ji0hmxNrM:A3k03kB56roPji0Aj
TLSH
T144654A16F6A44BA5D02BC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 906KB
SHA256 b530462bbd0398b356dddd8e0b651059e1c7f52041cf666e1ff1b8f3849bf157
MD5 ae2b4e54562578e4ee3aaeebc9f0bdfd
SHA1 c021e75b35ec505fb3aeed703e652af0f9126a25
SHA512 bb380cd0efc304d917e012b47d04b16cadf0df0efec88e182726fca23595caa3801cc063832b7c3731583920dec6e09ba3603142f893c5968315d3eb833965ab
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcb3a:A3k03kB56r
TLSH
T1AA157B03E6840FA4D10F81749A968662EA777C125F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 915KB
SHA256 c3e1007974db253619bed1bbaad95214b5a4d3283f52b7c02a06b0bd4efb8260
MD5 d3c40c5fef8e9a57700ff67f16f2fb64
SHA1 64696aad1abd84012e5533d06deb7128ae773eb4
SHA512 d44a62e202967dc2fb715f6005f307dfb2354056aa68f8cad73981bed1dab5dc575866316e72988385099219d23e9d013eff80acc323f7bc8d8c388e82fcfd40
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcb26:A3k03kB56rW
TLSH
T1BA157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 915KB
SHA256 5f7c090161f547e3335d65970b170fbeb9fc5c0e362163bdef1d276ffcdbba07
MD5 69a3f5bbda50d6ab1452cdf1e6818050
SHA1 9d525333a243540d009d42369a8180f57ad671e5
SHA512 82324978c28e72ce1793355d600f4af777e801a3b634ed82432971f3015cf31adae6ac0228f26d4cad253438a545507ab47da979b9e36644d4ba9def38a08502
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbmN:A3k03kB56rn
TLSH
T12C157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 915KB
SHA256 c1b7a42475d2898242654b0e6c69704f80ffcf3487397bef4d6bd77f75a48fde
MD5 0d10a67eacb6870f97d5354dacc96422
SHA1 4190f4b51135fb370b67e0fe9427e227061195b3
SHA512 dbcfa7402df8e921281357d5f3f4ff8770477f77def00d7ad8b3498a746b84f3b5c9df27cc663ad9fc12c06f74464b89642fb400dc2464e1a895110a7da54ef7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbkf:A3k03kB56rD
TLSH
T163157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 915KB
SHA256 749d652ebff389cee0a889f475b5900f060b95be6d7e95223c75481d66631274
MD5 fdb60aa8fffc0e92bf40a02cf57e9f29
SHA1 2f08d17d91448ef700bdb641c98c0dc6d29fc802
SHA512 388adde6a9137d898f679a3d87b5d59a569f20190125b4e05c3fd7227220df33a8f299aac1abdd0cbc431a6836e9510fef405439469622251648d8ab8f5bdbbd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbOo:A3k03kB56ry
TLSH
T13C157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 915KB
SHA256 9c42bab49812dddabaff43716d17eea4aec2cf76e290da7033d89394e54988ea
MD5 af3b811c19d6d6c16582e0192d648b59
SHA1 aff73c92c38fb1dd489fe80e970c8007b42fe028
SHA512 f81ac80080820d394dd9adcc4949a073e1d7c465e2c2f9a214396217e6960fb51c9bb897e87965327c291573a935de7af88b82d3aa270e352dea888cedc30491
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbiu:A3k03kB56rc
TLSH
T1E7157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 915KB
SHA256 8afab2679b6be3b9d30ef79cf910681767b59843c22449edb13c90addeca77ae
MD5 0ff7b816cd88ab8a35ef687987447618
SHA1 c635065931065a64c15b218a38b8dd0abe7c3d1f
SHA512 112ae8e432c68dd3c071686a765701ae95511a48a4ae709d70bce7a14baa023ae285056327523e06cb2c10a13196439e9e829e0d5cf710b252f7bd039088d1a9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcb29:A3k03kB56rB
TLSH
T19C157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 915KB
SHA256 8b8c77c6af1390044c178b2ecb45f77d8f9f27bdabb27291b54407cda1e7cd12
MD5 2e4ef118ecef349faca577bd042ca3e6
SHA1 d6b79fa0fd665ac6f3e5f274b091dc31ec7609df
SHA512 43eacc1b7a205b501f951d8a8ae903700028047d806b6a80e47643a609a837229471442cb3e2b10914316ca208f02328c27788571226c6bc4debb9cca5108d00
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcb2c:A3k03kB56rU
TLSH
T1D0157B13E6940FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 915KB
SHA256 28c638ac1f1b81efec9577e3e348cbea45f78c21c01fc104a6acfbdbda9b5d61
MD5 3d2e7e29af1ed18756eb697b7df317dd
SHA1 f76f5ece91153051d7a6bed57efcdd6add1cba42
SHA512 09ca1eb5537f20ab9f1b196e9c086e58a8bfc3c3a4736c701896d3d1e61dafb835cd645b4ad8e70cb723fb0323c785792f1e9da1960b97988b67d05d942ff0fc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbvp:A3k03kB56rC
TLSH
T16A157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 915KB
SHA256 cf8fb89c92ba15167d5b0b80e1d9a1b1aff8989fc19446025d41033b08f0c424
MD5 c249505bd33269fc2e17ce035d8588bd
SHA1 279d8ef59f6e59fed6ad7815a1e287c85f9464e3
SHA512 39d859fa83bb7a98f2098fa8e55b47fb113faef4e338028ae0a49742c6671d67e417f8c45f64b96389172e77180e64e206e8c998c500aa48c29da23dc27b5972
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbQN:A3k03kB56rl
TLSH
T16B157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 915KB
SHA256 23409053fc72f26cf612d5499fc027fcdc373891bd2d7e743e7281aa04e854cb
MD5 4dafec11d21dfd07a7f428ed1f9dde66
SHA1 8bee48158a6a3d6ae7ab364c681c4808b0bc43ad
SHA512 dcf8eb064581c80ae8621b75078cda9afca64ff6461490b1ed01eb6c1cfc6aa1fd9325ec53c9fbce88adfa4ec509fec7a016dadee662504f23060728ca8c9a9d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbYF:A3k03kB56rv
TLSH
T1F8157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 915KB
SHA256 9684031c8f6d8e7e1f4e0f3cfdb7ee386b1528f7c24dd18c0b2225807d95d3ac
MD5 be57fefb495c442e2ed9772c4e3c75f3
SHA1 a2ee8227cc80b60589ea6b396264228e1f2f413e
SHA512 2539071aa545a692077ce2a8385c9aa370a52a0849653b66c1a593cae407ded3a43b4ae6f5ff8ab3acb2112235d47188bc313836f4b9a99d64181dcdeeacad55
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbNC:A3k03kB56rj
TLSH
T160157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 915KB
SHA256 b0b8b9ac9da8ab674b11accd2fedcf13535e67468db24a6c94d1a67987cb6cc6
MD5 9e96b7fc217e3a741fd67fe7ade1634d
SHA1 f88842561df832ea6379c3da765edf40333f4607
SHA512 5b8bad0acd2d3da45450dfad3420bba630b141be006c96a605dbe5a2b2c931dcf9383fbf250a9672e749e6be31df890b7a1a0ceae3e6e0b1209915d86e544c83
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcb2w:A3k03kB56rm
TLSH
T180157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 915KB
SHA256 08df3ee96d1e7a900823a74f71533fb634c332bf6b29f98ffb07ef771cff4cea
MD5 9aecfb4e2e9d618137d92d5ee3d2bb5f
SHA1 9d9d0cd704439337140c2bb6f5c529b9ee3403a7
SHA512 6a21705b13016df08b8c7caf3c7dee595c43100c19721498bcd4d60af6b1f1edaaeda3495fb941317497abf9708afd6d3dc80bc77006dadacfa600855c99f49a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcblT:A3k03kB56rm
TLSH
T1F4157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 915KB
SHA256 da51c60c70afdc1d52532dd25777b3d5dcd05168a8be3bbc5ef215eba5cb5f83
MD5 405b5e4b7a60dc4fabe502d1af15944a
SHA1 1a4a7fda1da7c9f8b9ec1125a22060950eebd85a
SHA512 4334f2e4aaccbbe5eef16b5213f64d7206348344a444065b25d6287d8fc640050c26f667085bdc24c488f63c659204a8e57f00f4b6b38399f74fab8fcb07fcfb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcb7u:A3k03kB56rB
TLSH
T1D8157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 915KB
SHA256 2e3120ccf051ada4deca36fc31cc896380770e396ea355c338613d07cc605918
MD5 6d8c6d371c3791985506e66f94d29dab
SHA1 08c54167ee5409360f4b35c51f5f5685548666f7
SHA512 f98f216bd8faa98b849da0ebf9630055c5b43214280e806c1541b2fb797f97c267b420a892ab7588b7c28513c59b804db2ee05776655f3d682f299c39ba7cd58
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbfb:A3k03kB56rg
TLSH
T1D1157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 915KB
SHA256 af42f8cec527b018332a4f356fcfc1376fe98d82b9d91d6b3d51210b08c34a9d
MD5 3303979ba48170f4d27e29bfeaf70d94
SHA1 1afb59ef80bb924d48a19705d09a9e53629b81df
SHA512 5ca26338b7e666fdeb3bf142b5240fae4f18ef508664e0996c4d0f33d1614fe852aa8485dc82c8d75e8e8db6fd276792cc9cd6945015da2790843ba64550b23f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbbf:A3k03kB56rQ
TLSH
T185157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 915KB
SHA256 62ff9816c0584c185d7f384f891014a7a8f17d5410dd458eaa13883b5e0bd21d
MD5 16555b69ef013af724b6b5d3a77819af
SHA1 9da0fb8a0276481891483fd921679cb28929fb43
SHA512 cfc39a13bd5b083a699bcdc28f72fc5abce7c404332cdc9474f9b7216c9f5aeaa113badb21e6e866bca74e84473e875f7b87cca0644be573a891c3b41d473556
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcb0K:A3k03kB56rw
TLSH
T17D157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 915KB
SHA256 3de35fa50b549cf803b2c785c6a1492564cedd01e289100367e72d53db8d974b
MD5 2e4aed1bfa0917afd676c03bf7fd2763
SHA1 f9f1969794ef5869dcdbf77bca96ed8ff0fda8b8
SHA512 16d349d489e25c38640f3232be02efd2483b2c1c64935f08c8e57e0e37158c8c0164e100d6e7c2ae40a1fed9660c0d5688ba3a074b112a1f0d8b49207ccef7b9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbpk:A3k03kB56rZ
TLSH
T156157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 915KB
SHA256 e87eeeb6f95c492d1cddf1895e7cad3e8bf31f004b82bc3e941f1d9fb429f7b8
MD5 1725b3d87e1739704ba69a15b684fc3c
SHA1 8b9fb98f69218ce778dc777807f925f42b1a7667
SHA512 fd14112e9bd8de82cba6e6baaeaa4ee2aedf1fa13ea9a3a2d2b8bee82393b01f82200a05b29078042f80eaa2387eb51c3065f6dba008c0387adbc13e8c261b07
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbG0:A3k03kB56rs
TLSH
T117157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 915KB
SHA256 dd4bf7398ac79f6749d8a9fe4ed0c6c23c2a52535f98e75fc9c329aaca5f9fe9
MD5 0dfb98a4515c62233c9d55f977128b30
SHA1 a1729c5adf62fdde6c188122fbdbfd5054edc31f
SHA512 5660fcceabd4f81b8d287e5f9be28157f2df4595d714a1e58cfdee16d48f5a6be71de874c0f8c86d42215d77ac4a37f1bd6fc0575deb8d2909f9981ca6ed4ccd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbVg:A3k03kB56rR
TLSH
T16B157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 915KB
SHA256 de4f41ff41c00fcd650341001f330a0c66c1c7fedee49b9daa191f6b3cf85d73
MD5 4c21dc6da3276de24d6b004b47317472
SHA1 08ce2a3c03dcc424a145658874ca2b60238e3651
SHA512 3bf24afe85f2b5dc6fadc8708a167aae480af0408fbfe837ba0382b6f8f33dc8829c90aac0befeb81cd8e79a07ecfd61a90be9fb02e74f1e41e28d5ec8d248ff
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbkr:A3k03kB56r7
TLSH
T10B157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 915KB
SHA256 99419ee958ce2646953272dc5054986d4550acdd34f1d513ec67c376e519063f
MD5 a084768dcd4ce1089a379051df4901ae
SHA1 2aec839b1e6d4b69ecdef9127829ccf45012a991
SHA512 079e7e77b1b11fdcd8391cfc173a501617998158ecc3c1071d7facffa68601eb04bf3b9f70b7569199d9b82900f973b69d4895d07f7737e03c29438f4dcd3820
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcb6n:A3k03kB56rN
TLSH
T17B157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 915KB
SHA256 0bda2cc09645550502addbd19786d9316b0b47cd8fba10baea9d498e6f26bf34
MD5 dc19f93b2340fe186eeb02e3f66d2e6b
SHA1 98bbe86534fc8159877eaea7185fc77d873a1406
SHA512 afe07b6c4d8a710427fbcdb9a177a765203a24406eeaa1b9c5a5af6b54270dbb9173e060f429f56b4303815ba34dad8297b85b90f26b2bac4bc76a14ade4313f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbQx:A3k03kB56rz
TLSH
T175157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 915KB
SHA256 a3cea08846fa8d4af7bee83518878dc37d87126bdae6433434d5faa7b675fc8b
MD5 cfb59f76d82a127e54e9f44ef7ac4725
SHA1 4a6f254605c33f8a4ee71120222c16249dbbb260
SHA512 dedf7fe7b26b442711ce9d15eca64b08a78579466150e5b257cd439aeb4a9bbe036e852ac793c6cdb9677d75c13b9641d9a065c59f75a7db8e9c8cbc496217ca
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbSA:A3k03kB56rM
TLSH
T113157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 915KB
SHA256 a014d51dd77657cbfb2c58d32a40a549528737392b4f6f45a08e5185f29ca563
MD5 f1785d5bb54b57d02a37fb21eced84ab
SHA1 275ced6abfd5d142ada818515bb1312c8dd9a038
SHA512 ca721f6b848216a03a798d8de07952cf765563c7a38fed0a880e89b90309fc46273eb1179e63fc96023030cd37dadd3f0b865f84e5eb76dc861af3c3bb1e38b6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbr9Q:A3k03kB56rt
TLSH
T1E8157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 915KB
SHA256 6395a31c187d7e2505db454a0562c0070eb363f6025ecd5467af40285f70023e
MD5 33bd99b6b9ae417ee82316d271940228
SHA1 113c07421b748cc94a526ca2f61b1bcd6da88211
SHA512 639a34c3f7bf32c3fbdccbabc66412e185bbb33f8510d5bf769ea0cefc4731d7128d7a7b906009ecfba0326b0cf5af643a767c7ef4206f33edfe518d0a597757
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcba4:A3k03kB56ry
TLSH
T18D157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 915KB
SHA256 024d39b766e3c1ba4ee38ae4f08c2a36dc033d8b47690ecb9ac0d3f372768b4a
MD5 d9e4611582af04e8116694d995b7fac1
SHA1 b4fe921e6bc872e9e026208ec45dfc35814e55a7
SHA512 b22c2b13d1675622d061c21872b08d1ab89256d76438090e427d5469b17f13b3b41d248e2ce155d4a365f3380ef92d515c7f30dc9b615b60db68ece68cf4557a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbBu:A3k03kB56rj
TLSH
T10D157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 915KB
SHA256 557afa6522d354342f551ab75dc754bf39482ff6b189899ba1d953bfb09da7a3
MD5 b28c15a24f19dfcfa66aeda3909af468
SHA1 b4919a979b8dcb1288fe642e7b1ae1ae36828f27
SHA512 53cdabbe1ba3a41bf30b67589c3248df8bb67a5b810d1e38feb8093afac8fcd2c1fd75bbae38cf839ad4d334ed62544aabca31be4bc4602975f90085de8bc122
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcb0j:A3k03kB56rN
TLSH
T1C9157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 915KB
SHA256 9a445e5ed6c55ce06ff0cf302945a9a4909d8c798a85ce454a7639f746af2e1e
MD5 243ea4e5ce32ff67d3cf67376fcb8add
SHA1 796196bfb86c4f5df8be58480367dcf8aa093c4d
SHA512 bc2bb8c3bc89b30ffe581e593c9685223eae1d6be0348ff06d81721c933af0292f4452405c992eb4336e5616249cf559f795fca8476fafdb63810fa5bd4fe7a0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcb1g:A3k03kB56rR
TLSH
T1C6157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 915KB
SHA256 5c33e11aecb1d9c8281b55aaba3922f95c50edf09d8bb0745dd316885620b8ec
MD5 b338e4b4e9e91c1d94835494d5b0ef41
SHA1 3c432466e5eb84c571c8ba52d64046881eed3ac6
SHA512 e400a8d7a2e58cec2ac865a7cc5ff905f8a62ef96e0dbb40f75c7570c029840ed82ed92b270ee83677e580a3f9e7a94ab3a720ed990004a6a739bf266d828b30
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcb0I:A3k03kB56rA
TLSH
T164157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 915KB
SHA256 7788f1305b59b3c70b4c8486d4092227ce834f95b55c5e664562e4c64922661b
MD5 9e57a964cf963a4abc406ba1dbc53b06
SHA1 52b84d5923bb51609905be5148f6f1fcac1bb4ed
SHA512 b7112306dba863109501e1d4502051fe06df86d1cc9f3bdedfe49edf2b4e5508ac0734207eb8681a2a71b72d1bc51ac82e2690eae86122f7076a16f0ef2b9b43
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbmo:A3k03kB56ri
TLSH
T12B157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 915KB
SHA256 f4b4b43b7668c796d70017d5175042243d09ea2f68d9833b0e5db2a2e31c9f8c
MD5 8c092756c3b835fb8de7b2ce63865d5b
SHA1 8998322cc915fb3ca73ac10c41a7a4b7b5e33b43
SHA512 4ea8d4bc1a15f90c7840bbc99e784c7cc84914e4820f03e381f3d4f38f1919334d8c827ac6b8433bbb45f4bc85c9cf0f12f642e8f5074f269030b41b225153ae
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbN+:A3k03kB56rH
TLSH
T182157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 915KB
SHA256 a1938e82d52fac7362f1745dbbfff52b008c123d06102c2dfee9ed1e81074f26
MD5 ebd3437ed0a597fd5ad752471ad539b1
SHA1 026841cfdf31e7988788a6755a008b6fb0ae842e
SHA512 9c9b572073867c5124a067d502d75b709fffba82e55f71a3115451f393ddb3ed2d68581808a91ef18af6ecbcb29b2070e5e7d5a34598dba5599cc8f0e91f1163
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcb7Q:A3k03kB56rz
TLSH
T1A8157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 915KB
SHA256 0544570420e269b20f4d6ccfcecc1c0367a87e26afe1836ca5f37212ca1309db
MD5 8bd0552318ff9399099b93cc16340104
SHA1 d92b56dfdacc7b4a03ce2d0f2afba6f3f1d0b623
SHA512 93275f10c7b43750520f08c26a6c1b911781b3b6140e54f60833f042831a6b6484ce670f208d0280151fda213d4257eda1f571967975f2bc7bd3086d7f712a76
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbwX:A3k03kB56rn
TLSH
T132157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 915KB
SHA256 f170d74fc3f95c94a7ae511750d51a4c7a7e77e8e0a1caf39e20aea187204941
MD5 67aa29615860711e70f9981677a9949e
SHA1 3fd2a4a8ef80590bf518c422831e595cc662b1ff
SHA512 abcd096934513f223fa23200fbae89734d8c36a3c0bce8a01293c1e55078725b90be17e6d929a98fbae95ea69a7844b423210f988a909f968b876d8036ee80ba
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbGL:A3k03kB56rJ
TLSH
T1A8157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 915KB
SHA256 f7c8fef36240a935ec7d01297278fd1c9c35da0835607022f6053f9221c7e763
MD5 83254b2b6259da35e131bde8cd27ef29
SHA1 7435abbdcaedd2ede397367dba3e641fd2ccc9dc
SHA512 7bc379199c2edee80c78385d7b3fced8a6d81901baa6240a2e92724b8ecb489830378d7c17b0b5062b4692c83c3be5726c0d5b7f3b71677fe91a75ad4787f1a3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbaM:A3k03kB56rw
TLSH
T19B157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 915KB
SHA256 3cf2e3fc378d27b58e83ceb5f54f8f70cde8f3ccc6f3026c8edafc816059b458
MD5 8c14f7854bf9eae0071332c29c3e71df
SHA1 2f7b3c6cf894ca8159dca4956b1065e9d8859930
SHA512 3707bce2fb503380549381de00a7b4c112f54e4639d77351b7025443355c228606d56cb229c682b4f188576a19213fbb6eed644168f39115e64b2ab902a03f9d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTcbLh:A3k03kB56ri
TLSH
T191157B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5732-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6128-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6128-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads