c445d68490f3094c1c08af462c2928ac1bd140d9dee59e53df4672664f624dc4

Analysis

max time kernel
109s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 886KB
Sample260818-vrvb1aad68
SHA256 c445d68490f3094c1c08af462c2928ac1bd140d9dee59e53df4672664f624dc4
MD5 9f5ecf8bb23b51109c40f7934c723ab4
SHA1 e53b8b0d96d7b694add5550fe4d1fda0816058a4
SHA512 bef133eee834768518e72c0a3574c490fdf682ac07fa644543dcc4a5d297cabc93e7e57829ce2cb8f26fbd2b867e0521243a743ddb4d421d80fcbd471aedafe5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJ9:A3k03kB56r6
TLSH
T144157B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 25 IoCs

resource	yara_rule
behavioral2/memory/4592-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c3e0-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2a3-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4592-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4312-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c3-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c85-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c3f3-396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000198ef-481.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-512.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-604.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-630.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-721.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-746.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-789.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-826.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-857.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-876.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001a5a7-1000.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001a79a-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001a79b-1074.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000700000001ac34-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000700000001ac32-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000800000001ac2d-1377.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 22 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c3e0-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2a3-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c3-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c85-60.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c3f3-396.dat	aspack_v212_v242
behavioral2/files/0x00040000000198ef-481.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-512.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-604.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-630.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-721.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-746.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-789.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-826.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-857.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-876.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-895.dat	aspack_v212_v242
behavioral2/files/0x000300000001a5a7-1000.dat	aspack_v212_v242
behavioral2/files/0x000300000001a79a-1043.dat	aspack_v212_v242
behavioral2/files/0x000300000001a79b-1074.dat	aspack_v212_v242
behavioral2/files/0x000700000001ac34-1215.dat	aspack_v212_v242
behavioral2/files/0x000700000001ac32-1339.dat	aspack_v212_v242
behavioral2/files/0x000800000001ac2d-1377.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4312	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4592	2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
4312	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_9f5ecf8bb23b51109c40f7934c723ab4_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4592

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 886KB
SHA256 c445d68490f3094c1c08af462c2928ac1bd140d9dee59e53df4672664f624dc4
MD5 9f5ecf8bb23b51109c40f7934c723ab4
SHA1 e53b8b0d96d7b694add5550fe4d1fda0816058a4
SHA512 bef133eee834768518e72c0a3574c490fdf682ac07fa644543dcc4a5d297cabc93e7e57829ce2cb8f26fbd2b867e0521243a743ddb4d421d80fcbd471aedafe5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJ9:A3k03kB56r6
TLSH
T144157B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 cce2b9b9e3e2ee2287fac12465c407b7a7e5c6284757206a228f8f6d3d7e30e8
MD5 c05c7dd6e214ccf52830ec7492deec3b
SHA1 3e0bb140d349ae65d529293a52d6f4188cba81de
SHA512 eb36637380e469a5b0c576541cbe431ec0cc44ed1c8cfeff0ba6ae13acb98e2810e16c0bbb9fcd8aad14d5d5cd546edca5153b3599338b16331cfe7ff717a43b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJJ0Le5ji0hmxNrM:A3k03kB56rKPji0Aj
TLSH
T143655B16F6A44B65D02FC078C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 900KB
SHA256 3486810e91a4e6b6b43b0d687cd82b53e9e4c290eef95df9861e715dbc699e37
MD5 23aa50f8f6eb9f93f91a49723446989a
SHA1 a00a85098d69add3cefb963fa190fa1877e7027d
SHA512 bffccf2d72e4b50f1f8baf41482196cdbb60d88d2b9b98ffb6d69c25987ba9bc6e5d65b0363cfbdaeaf03664a223b2f8628a9fafd61dee84d78f069769148f27
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJba:A3k03kB56r
TLSH
T133157A13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 934KB
SHA256 86fa6a58669d351ecb29b88ce84acc33331b7a1692fcc855143fbe4e8eb9985d
MD5 0c6a4e9bd18548e46be34f072c4bb769
SHA1 7200c62c5003a01223e5dc699890c99014be3665
SHA512 8f9a1b38e075d5f1528569de24c4dbcda2a8d7f246e3433ef6108be1f3d61286cf53150d16a4d491a3ca0ef61b87814c18cd2ef9714c3a513789d7002b2bed42
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJ4b:A3k03kB56rPb
TLSH
T134157B03E6940FA5D00FC1749A958662EA777C466F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 909KB
SHA256 1976e2cfabc72b1f5588c3721994c58b4e1f306e30f131677c5a78972474224b
MD5 fcb16b3aa136bc788be3687601290aa6
SHA1 f78ad48b2a62939271186ffa7814ac6fd02e3cde
SHA512 13acd6f68194e189ba998fcc7782036040ef5073d721db43f2b429d74a2ab6ef11d0581b581be574c54437abaeea2c937eaf82489c7a7bfef54afe4c9939eee2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJW4:A3k03kB56rc
TLSH
T1E8157B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 909KB
SHA256 19972ae4ba772bd8d17ef6a8ef3b123106606719e07bfef604e3cfe775ce3a63
MD5 5136dce05d46b232428e0bd2ea24606e
SHA1 3ec4eef1ed658c6a2ddee5b5c9af77cdb3275348
SHA512 0a2efee100235db4a33e158b69cba8e63e32cd1b4ec34a1b0bbd97154f407d48293119304ef5615231c359694641e5d05cb291f927806719bbff383ef0cde651
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJFu:A3k03kB56rd
TLSH
T1C5157B03E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 909KB
SHA256 31e0a8b0942a0cad27de38cc30d7735504f309d9dc41e4343335f734730fa8c8
MD5 e386cb091f76ab333a9efb26f44d93dc
SHA1 07afc06f74f064f54ce1d8a62ab6ecfb715fc8aa
SHA512 4e9449397c4a91dcc8385242b7211ece6e5552e70963c0ec832b448bee58686bfc0869167c1c2e44c61207261dbe48c8486c53797fa918a898bfd02eb81a70a8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJYj:A3k03kB56rf
TLSH
T13C157B03E6850FA5D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 909KB
SHA256 9d12381276d4bccfc5e8689406b69a55979d483d3b69499418009a54f92563bc
MD5 a8f554da65d5272ca67ee35185e44b8e
SHA1 ca14ed3e1e82692266e123dea735f34808c1f4f9
SHA512 50f61256889622d571508c369809afc12108d218a4b911541ee352909d5ecd00f46631ee47828a99b32eb952de2d31d48f6020c308ecee19ab39e1785c3bee95
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJpg:A3k03kB56rX
TLSH
T1B8157B03E6850FA4D00FC1749A968662EA777C465F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 909KB
SHA256 7d209064c02da8ad9821897305abc1569c452f77a945c8f8d42a4a277be06e26
MD5 59827103f684057f7d2806220194282d
SHA1 d9bccf234453e1a491bf6831f92279087d7c2eed
SHA512 c6db69ea4a2a77fef7d94109424bdbed2cc745ba80cf6989d7cd5a0aefef801ea80d2d8d2b2ac6a9011f15316be6e21b83f9145e0aafd94f0f5b495bbf5c23a7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJwI:A3k03kB56rW
TLSH
T108157B03E6850FA5D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 909KB
SHA256 e87bd95ac92d2798ae626e23705cf5e84a0faaa836fb7c5e37ca5a33e9d86d9f
MD5 46c06db89397cbf626fc40452ede4aff
SHA1 a101e1e51d31f35bae51e47805f3d13e1fe52d15
SHA512 1567104feb97edbd6197128875fd605735f3a5689dacf45a5950b8cf0554fb8dcb584d62b9d9325c6311ca5a47ae6fc57ac339937c00503044de8d9c773cdb02
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJyo:A3k03kB56rk
TLSH
T191157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 909KB
SHA256 212b942865512f6f37d7596a9620dbc062d66509e2f295821a022a814296d9ef
MD5 ca91630f6ca1c4b8da93ecd5ebce23d9
SHA1 09ce2849f9abbc27047e3b17ebabc24ad4fc6a42
SHA512 099fc88bbf0c41aa4a12a62c811826245bb0a0d8f12d3a3a95cd7c5d5aa512b9c5eed18651aa463e9cf1b4402da251310771e9a945d24018a02481558ce86bad
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJp+:A3k03kB56r5
TLSH
T1B4157B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 909KB
SHA256 50aae7dd19f645795029763b7952e79c97b3245c0c54392b96ccd2dd5ca13fe5
MD5 6610bccc08c228d38c4a6d8b263ff5c0
SHA1 4fe51cdb494cb60f1dec458445dd370eed7d1719
SHA512 195ff19f56c3d2c333d16f3130107bcec8eacd5360370e00883c23796a98988a201a46bd101b9fc1f8dcdf9ccadea19ec852af60fcb18c722caf4e00bff4b3a8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJXQ:A3k03kB56rJ
TLSH
T10A157B03E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 909KB
SHA256 7fb2689113b536a08039f090d7ffddf56cd91f2180afac5946f9813d87b8bce7
MD5 743961042e090d3ce438b0dc022acd68
SHA1 fd562ec95f8ca3d11b2befc9a908fced6b2a20d1
SHA512 0d76849927b6e0266a066d7e971540ba8288aeb78593032f142528c393ed908d19f819fb73ac8c21533455499683187f5d936ebee6cbf00b77caabca93935b0b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJsX:A3k03kB56rV
TLSH
T17C157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 909KB
SHA256 4f4792314700f6ee077623fdd13c44167dd44fbd3b42c0415353cb219909f0c8
MD5 252dbe37205b891c6d244150ec4a303a
SHA1 5cbcb3e3f46b852656748d2ded093d928ecca2eb
SHA512 2c15818cd824fdede06081ee3fe3005fd2f43ab600b23a3270d73651355a379dbf52f86d101dd3b7c0297684cfc1acc2bb82eec54b4a973e973ea9cad7d267c2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJKL:A3k03kB56rH
TLSH
T120157B03E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 909KB
SHA256 a993abe7dfd4c003790a54249e36a9b72748103379e549d08c4cb5841a520911
MD5 7c94b85db3d78139c15107101db833ad
SHA1 47b997e5e672f60d92cf3e73f778bc6310d37a9d
SHA512 7326a1e7cfbf2c4b48ca8eed6c60f7ac4482e62b6ad041c7900c77a8a1ac832eb5a670e0fa1e3b03c26d71f60e865058088bf722da4f22ca4b93344bb962a587
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJuM:A3k03kB56rC
TLSH
T1D1157B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 909KB
SHA256 3640914282d234746acb9c69f9f47f324d6a093e4b1900de10376e445857c9f1
MD5 154e3d60cacb64835203f5676726111e
SHA1 e92ef9d64bfc3ddbe09442a67182e24a36d599a9
SHA512 cbe9c35dc1492b4a0aa941de7bb59b53ac06f98620f9562983c7bbd3144b9f8a180b7b98e11de28328541702035e64f244e938d820c299a6d13a3a0f051a1847
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJ3h:A3k03kB56r8
TLSH
T117157B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SELFCERT.EXE

Path C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE
Size 919KB
SHA256 b10956b8c274c550e9c8a0e0f3380219609c8edbf35869ebdc8bc14c539e31a3
MD5 3229d1e4491f88187d630d1025d6159b
SHA1 1dc46fb00c427b1517fd9715fcc474b1d7fbd7f2
SHA512 1eb8c088a2659d28eab190240b4e19db5a8bd58c287eb3011876718454b1ad60afe9369cfd489ed4137523dcb6d0f7c3fd2692ca13efcd63f39f07ad4264289f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJk1:A3k03kB56rH1
TLSH
T193157A03E6850FA5D00FC1749A958672EA777C425F6093DF2358AE153F72BC06B3A29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETLANG.EXE

Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
Size 962KB
SHA256 41a9bacbe548eeaaf4446612bd081392801d62b7369d23316344c284e290e675
MD5 372b17eade34f94a825603774004e927
SHA1 49c189b00e521226c263c061ed530eec2978cf2c
SHA512 4a4a34455529cdfe959deab242d50d987e59c544122e42964bd2cb431301ef301faeafdeab26b5a4ff68874611e22313a0163d5cbedbe30c6a55bb1169c0dcde
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJ6kUl:A3k03kB56rb
TLSH
T1CA255B07A6840FE8D40F81749A958672EA777C425F20A3DF2358BE153F72BC06B3A657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wordconv.exe

Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
Size 930KB
SHA256 1d3ab6b475a3620ec777b4e826476a1cd6ec1f443cbd72ce358f38e5a70f5354
MD5 c24bcb1be916089a5b0439ffe9cd9bf0
SHA1 1835b069f2dafe981bf3b40f5cdddd5ddbfa4833
SHA512 7af02e11b26fe014b721ec7cc7c9f63b9631923a278c706bb679392533776c476110e66a055e6d2895e587847f3cf226682944dd3f1174b4da90f23de4ab72bd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJEwE:A3k03kB56r7
TLSH
T1F3156A07E6850FA5D00F81749A958672EA777C421F2093DF2358AE153F72BD06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msouc.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
Size 941KB
SHA256 dc25b7fb8d774aa2da8474216d02af7ab33d682f72f2757ff2f56737bcd04d23
MD5 5e5a1ac4072a30a289093273228d2152
SHA1 7dffb822a7f3511b9a316d6a652bfea98e0f2042
SHA512 5d33c0787f29dc7a2aed2d22a8e9b4f512e17f2c4fd3a6c4c91e453f8fd235995cf97b4992d8267b58b352c1c720f48d64ddff33796dbcd7bd7e3f7851ee1a37
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJL2+:A3k03kB56r9+
TLSH
T175257B07E6850FA5D00FC1749A958672EA777C461F2093DF2358AE253F72BC06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osmadminicon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
Size 947KB
SHA256 4ba9cbbf76d74d4292189c692443913782b891f593374c5ce6230005b08dce97
MD5 b742768dff40e3a24ae1d53b500fd611
SHA1 bdfb01bd974b1b713073f31932c685856160cc53
SHA512 239756b4c0a05c196838e8b701a136077b05a0d240a612781c62771ffc982cff93ec693d9312a0f471a6216baf1595dff2af75f9d7184bb532326afa7bee0ee6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJS:A3k03kB56rX
TLSH
T145254A13E6840F94D00F917096994622E673BC0A1F6053DB177CAE253F66BF07A3D6AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sscicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
Size 965KB
SHA256 0979eef4af65062941c27b401934e38ed8566cffc91958c37a65cdaaa8d8a326
MD5 b9196ca453ef0f3954615e00dc72978f
SHA1 7324fc18a4c289621b52369612e0e3a4a219567e
SHA512 1448828b1cb6f4193a3496ae40ce95787e09ac18125e1c918b5bd27345aec91478f688fbcbfa52deed84112263188b9b532b9dd8bbf5e0c7a41ef92c6e5b2d00
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocyyAiJpF:A3k03kB56rq
TLSH
T164255A03E6850FA5C54F81309E968662EA377D821F2097EF1358BF253F32BD06A39657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4312-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4592-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4592-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads